A municipal-accounts investigation needs authentication patterns, rare logons, and access anomalies. Which ES dashboard family should the analyst open first?
Select an answer to reveal the explanation.
Short Explanation
Badge-reader questions live on Access and Identity. Rare logons and municipal-account oddities are not first a malware, URL, or DNS dashboard. Match the domain to the telemetry.
Full Explanation
Enterprise Security security-domain dashboards group content by telemetry type. Access and Identity views hold authentication patterns, rare logons, and access anomalies for municipal accounts. Endpoint, Web Intelligence, and Protocol Intelligence remain available for process, URL, and protocol questions, but they are the wrong first pane for a logon investigation.