Both the civic firewall and the EDR wrote overlapping events for the same clerk workstation. How should the analyst tell which product produced a given event?
Select an answer to reveal the explanation.
Short Explanation
When two cameras overlap, you still need to know which camera spoke. vendor_product is that label in CIM. Index time and disposition are not the product nametag.
Full Explanation
The CIM vendor_product field identifies which product generated an event when multiple sensors overlap on the same host. That lets an analyst separate firewall session records from EDR process or malware records without guessing. _indextime is ingest time, and notable disposition classifies analytic outcome, not the sensor. Use vendor_product to disambiguate overlapping civic tools.