A city endpoint team just onboarded Sysmon and asks the SOC for hunts that actually use that sourcetype. Where should the analyst look first?
Select an answer to reveal the explanation.
Short Explanation
Need Sysmon hunts, and that is exactly what Security Essentials is for. SSE maps data sources to searches and bookmarks so the city does not start from a random gist. Clustering maps and APM traces are the wrong drawers.
Full Explanation
When a city endpoint team onboards Sysmon, the first place an analyst should look for hunts that use that sourcetype is Splunk Security Essentials—its searches, bookmarks, and data-source mappings exist to connect newly onboarded sources to content. Random GitHub gists are unverified and often mismatched to municipal CIM and TA conventions. The indexer clustering map does not list hunts per sourcetype. Splunk Observability APM traces are the wrong product surface for Sysmon detection content in an ES-centric civic SOC. SSE shortens time-to-value after Sysmon onboarding by showing which content expects that data. Exam caveat: SSE content still must be adapted to local index names, sourcetypes, and Asset and Identity context before promotion to production correlation searches. Operational check: in Security Essentials, open Sysmon data-source mappings and bookmark relevant searches, run one adapted hunt against the new city Sysmon sourcetype, and record gaps for engineering if expected fields are missing. Document the revised approach in the civic SOC runbook so the next on-call analyst inherits the correct pattern rather than the anti-pattern. Retain Job Inspector evidence with the change ticket for municipal audit readiness.