Technical intelligence provides a C2 domain used against other city networks. How should the civic SOC operationalize it?
Select an answer to reveal the explanation.
Short Explanation
A C2 domain in a PDF nobody greps is a sticky note on a dark monitor. Drop it into the ES threat-intelligence framework and look for Web and DNS hits. Whiteboards and mayor briefings do not search last night's resolver logs.
Full Explanation
Technical intelligence provides a C2 domain used against other city networks. The civic SOC should load the domain into the Enterprise Security threat-intelligence framework and search Web and DNS matches. Civic framing matters because cities share adversary infrastructure; a C2 domain only protects the municipality when it is searchable against local resolver, proxy, and web telemetry rather than stuck in email or on a whiteboard.
Emailing a PDF to the night shift and assuming someone will search it fails by concept: passive distribution does not operationalize the IoC for correlation or analyst lookup. Printing the domain on the SOC whiteboard and skipping Splunk fails by concept: whiteboards do not query historical DNS or web logs. Using the domain only in a strategic briefing to the mayor fails by concept: a single C2 domain is technical intel, not a strategic targeting narrative for executive risk appetite.
Exam caveat: SPLK-5001 expects technical indicators to be loaded into ES threat intel and hunted—do not leave IoCs in PDFs, whiteboards, or mayor briefings alone.
Operational check: Add the C2 domain to the ES threat-intelligence framework, run retrospective and live Web/DNS/proxy matches, investigate hits, and escalate confirmed beaconing before relying on informal notification alone.