A parks notable names a seasonal intern's user and a kiosk src. What is the CIM-correct way to see that intern's logons, then egress, then browsing?
Select an answer to reveal the explanation.
Short Explanation
CIM is the shared nametag system—user and src mean the same thing on logons, firewalls, and the proxy. Start on the notable, then hop models without renaming the intern every time. That is the whole point of normalization.
Full Explanation
When a parks notable names a seasonal intern's user and a kiosk src, the CIM-correct way to see that intern's logons, then egress, then browsing is to keep user and src and pivot from Authentication to Network_Traffic to Web using those same CIM fields. Shared normalized keys are the point of CIM: one identity and one source address travel across models for a continuous municipal investigation narrative without re-labeling fields at each hop.
Re-extracting a new field name in each model so Authentication uses acct and Web uses visitor breaks pivots and defeats normalization across the parks investigation. Searching only the Malware model fails because parks kiosks routinely generate Authentication and Web events that a malware-only search would miss when no sample is present. Dumping index=* for the intern's display name while ignoring CIM field names is noisy, slow, and non-portable across sourcetypes.
Exam caveat: pivot with stable CIM fields such as user and src across Authentication, Network_Traffic, and Web; do not rename those fields per model.
Operational check: from the parks notable, copy user and src, run Authentication then Network_Traffic then Web filtered on those fields for the incident window, and document the chain in the Enterprise Security case.