An ISAC strategic report says municipal finance systems are a rising target this year. What is the best use of that report inside the city's Enterprise Security program?
Select an answer to reveal the explanation.
Short Explanation
A strategic report is a compass, not a fire alarm and not a bag of hashes. Use it to brief leadership and pick which ATT&CK tactics deserve coverage in ES. Do not auto-close notables or pretend the PDF is a threat-list feed.
Full Explanation
An ISAC strategic report says municipal finance systems are a rising target this year. The best use inside the city's Enterprise Security program is to brief leadership and prioritize which ATT&CK tactics the SOC must cover—not to auto-close notables. Civic framing matters because municipal finance is a high-value civic domain; strategic products should shape coverage priorities and leadership context while operational and technical intel still drive hunts and threat lists.
Auto-closing every notable whose annotation is not named in the PDF fails by concept: strategic reports are not an allowlist for which detections may fire, and silencing unmatched notables creates blind spots. Loading the PDF as a technical threat list of hashes fails by concept: a strategic narrative typically lacks operational IoCs and is the wrong object for threat-list ingestion. Treating the report as a correlation search that fires on one C2 domain fails by concept: a PDF is not a search, and strategic text does not become a single-domain detector.
Exam caveat: SPLK-5001 intel-tier questions expect strategic products at the program and leadership layer—do not misuse them as auto-close rules, hash feeds, or correlation searches.
Operational check: Extract ATT&CK tactics relevant to municipal finance from the report, map gaps to ES detections, brief leadership on rising targeting, and leave notable triage and IoC matching to operational and technical workflows.