The county wants protocol-level DNS and HTTP context on civic hosts. When will Protocol Intelligence / stream dashboards actually show that data?
Select an answer to reveal the explanation.
Short Explanation
Protocol Intelligence is empty without the protocol feed. Onboard Stream or similar, then DNS and HTTP show up. It is not a second name for the queue and it does not replace Authentication.
Full Explanation
Protocol Intelligence dashboards show protocol-level network data such as DNS and HTTP when Splunk Stream or equivalent protocol telemetry is onboarded for civic hosts. Without that data dependency, empty protocol views are expected and are not cured by opening Analyst Queue or renaming notables. Claiming they always show data because notable titles include protocol fields fails by concept because notable titles are human labels on cases; they do not populate Stream protocol dashboards. Claiming Protocol Intelligence appears whenever Analyst Queue is open fails by concept because the queue and protocol dashboards are different ES objects with different data dependencies. Claiming they replace the CIM Authentication model for all civic logons fails by concept because Authentication remains the identity and logon model; protocol dashboards complement network context and do not supersede Authentication. Exam caveat: SPLK-5001 expects analysts to know Protocol Intelligence depends on Stream-like data before treating empty panels as detection failure. Operational check: verify Stream or equivalent sourcetypes are collected and feeding Protocol Intelligence before promising DNS/HTTP protocol context; otherwise onboard that telemetry or use proxy, DNS logs, or other available sources.