A parks notable names a seasonal intern's user and a kiosk src. What is the CIM-correct way to see that intern's logons, then egress, then browsing?
Select an answer to reveal the explanation.
Short Explanation
CIM is the shared nametag system—user and src mean the same thing on logons, firewalls, and the proxy. Start on the notable, then hop models without renaming the intern every time. That is the whole point of normalization.
Full Explanation
Shared CIM fields such as user and src let an investigation pivot across Authentication, Network_Traffic, and Web without vendor-specific names. A parks notable that already has those values should reuse them in each model in turn. Inventing per-model aliases or falling back to index=* undoes CIM. The Malware model is the wrong first stop for a logon-then-browse story.