Leadership asks two questions: which civic hosts talked to a listed C2, and how analysts handled the resulting notables. Which dashboard pairing answers those?
Select an answer to reveal the explanation.
Short Explanation
Threat views show who talked to bad infrastructure; the audit view shows who worked the queue. Don't swap those. Posture and access-anomaly panes are not the intel-match log.
Full Explanation
Threat Activity and Threat Intelligence dashboards show matches against threat intel, including which civic hosts communicated with listed C2. Incident Review Audit reports analyst workflow on notables, including ownership, status, and disposition timing. Swapping those dashboards, collapsing both questions into Security Posture, or expecting Access Anomalies to list C2 matches is a 4.5 identification error.