Both the civic firewall and the EDR wrote overlapping events for the same clerk workstation. How should the analyst tell which product produced a given event?
Select an answer to reveal the explanation.
Short Explanation
When two cameras overlap, you still need to know which camera spoke. vendor_product is that label in CIM. Index time and disposition are not the product nametag.
Full Explanation
When both the civic firewall and the EDR wrote overlapping events for the same clerk workstation, use the CIM vendor_product field to disambiguate which product produced a given event. vendor_product preserves sensor identity after normalization so analysts can trust src and dest while still knowing whether the row came from the firewall or the endpoint agent. That disambiguation prevents double-counting and mis-attribution during municipal workstation investigations.
Ignoring vendor and treating every event as the firewall collapses two sensors into one false narrative and can hide EDR-only process detail. Using only _indextime fails because ingest time does not encode the product name and only reflects when Splunk stored the event. Using the notable's disposition field fails because disposition records investigation outcome status such as open or closed, not sensor product names.
Exam caveat: overlapping multi-sensor telemetry requires vendor_product and related CIM vendor fields—not _indextime or disposition—to tell sensors apart.
Operational check: on the clerk workstation case, split contributing events by vendor_product, verify firewall versus EDR timelines separately, then correlate findings without assuming every normalized row shares one sensor.