Technical intelligence provides a C2 domain used against other city…

Question

Technical intelligence provides a C2 domain used against other city networks. How should the civic SOC operationalize it?

Accepted Answer

Load the domain into the Enterprise Security threat-intelligence framework and search Web and DNS matches — A C2 domain in a PDF nobody greps is a sticky note on a dark monitor. Drop it into the ES threat-intelligence framework and look for Web and DNS hits. Whiteboards and mayor briefings do not search last night's resolver logs.

Answer

Email a PDF to the night shift and assume someone will search it

Answer

Print the domain on the SOC whiteboard and skip Splunk

Answer

Use the domain only in a strategic briefing to the mayor

Technical intelligence provides a C2 domain used against other city networks. How should the civic SOC operationalize it?

Short Explanation

Full Explanation