A public-health SOC receives strategic, operational, tactical, and technical intelligence in one packet. The night analyst's question is "what do I search for tonight?" Which tier primarily answers that?
Select an answer to reveal the explanation.
Short Explanation
Tonight's shift needs license plates and the plays they run before sunrise — IoCs and current TTPs. The health-board story is for tomorrow's briefing, not the search bar. Pick the tier that puts something in Splunk tonight.
Full Explanation
A public-health SOC receives strategic, operational, tactical, and technical intelligence in one packet. The night analyst's question is "what do I search for tonight?" That question is answered primarily by technical indicators and immediately usable tactical TTPs that can be hunted or matched now. Civic framing matters because public-health SOCs still run shift work; board narratives and multi-year architecture notes do not populate the night-shift search bar.
Using only the strategic narrative written for the health board's annual retreat fails by concept: strategic intel informs leadership and long-horizon priority, not tonight's observables. Following a three-year architecture recommendation with no observables fails by concept: architecture guidance lacks hunt-able indicators or TTPs for the shift. Relying on an Enterprise Security annotation with no matching correlation search fails by concept: annotations are metadata and create no notable without a matching search—they are not search terms.
Exam caveat: SPLK-5001 intel-tier matching expects the decision "what do I search tonight" to map to technical IoCs and usable tactical TTPs—do not hand the night shift board prose or architecture-only notes.
Operational check: Extract IoCs and current TTPs from the mixed packet, load indicators and run hunts in Splunk before end of shift, and park strategic and architecture content for daytime program consumers.