The county wants protocol-level DNS and HTTP context on civic hosts. When will Protocol Intelligence / stream dashboards actually show that data?
Select an answer to reveal the explanation.
Short Explanation
Protocol Intelligence is empty without the protocol feed. Onboard Stream or similar, then DNS and HTTP show up. It is not a second name for the queue and it does not replace Authentication.
Full Explanation
Protocol Intelligence dashboards depend on Splunk Stream or equivalent protocol telemetry. With that data, analysts get protocol-level views such as DNS and HTTP. Notable titles, Analyst Queue, and CIM Authentication are different ES objects and do not populate Protocol Intelligence by themselves. Knowing the data dependency prevents treating an empty protocol dashboard as a detection failure.