Housing-authority engineers added a ransomware-hash intel table. The analyst must confirm lookups hit before any correlation search uses that table in production. How can they test it without querying live indexes?
Select an answer to reveal the explanation.
Short Explanation
Treat the new hash table like a spare key you try in the lock before issuing it to the night shift. makeresults plus eval of a known test hash, then lookup, proves the table hits — without poking housing-authority indexes.
Full Explanation
A safe test pipeline is makeresults to create a row, eval to set a known ransomware test hash, and lookup against the new intel table. That chain never queries production indexes and can be run before a correlation search depends on the table. Waiting for a live sample with index=* is neither safe nor controlled. transaction and rex do not validate lookup-table matching.