Yesterday's infected DHCP address now belongs to the mayor's laptop, and a malware notable names that laptop. The lease was reused after the infected host left. Which disposition is correct?
Select an answer to reveal the explanation.
Short Explanation
The address moved. Yesterday's infected kiosk is not today's mayor laptop just because DHCP reused the lease. The story about who owned the IP is bad data, so the disposition is False Positive - Inaccurate Data—not a true positive on the mayor.
Full Explanation
When yesterday's infected DHCP address now leases to the mayor's laptop and a malware notable names that laptop, the identity binding is wrong after lease reuse—disposition False Positive - Inaccurate Data. The malware analytic may still be valid against the prior infection story, but the current asset mapping is stale and must not indict the mayor by IP alone. True Positive - Suspicious Activity on the mayor fails by concept because an IP match after DHCP reuse is not confirmed malice on the new leaseholder without corroborating host evidence. Benign Positive - Suspicious But Expected fails by concept because DHCP lease reuse is not approved malware activity on the mayor's endpoint. False Positive - Incorrect Analytic Logic fails by concept when the malware signature or search logic is not the defect—the telemetry-to-identity join after lease churn is. Exam caveat: SPLK-5001 distinguishes inaccurate enrichment or identity data from incorrect analytic logic on municipal DHCP-heavy networks. Operational check: verify DHCP lease history for the IP, correct Asset and Identity or investigation notes to the prior infected client, assign False Positive - Inaccurate Data for the mayor naming, and hunt the original host.