A public-health SOC receives strategic, operational, tactical, and technical intelligence in one packet. The night analyst's question is "what do I search for tonight?" Which tier primarily answers that?
Select an answer to reveal the explanation.
Short Explanation
Tonight's shift needs license plates and the plays they run before sunrise — IoCs and current TTPs. The health-board story is for tomorrow's briefing, not the search bar. Pick the tier that puts something in Splunk tonight.
Full Explanation
Intelligence tier must match the decision: what to search for tonight is answered by technical indicators and immediately usable tactical TTPs that can be hunted or threat-list matched in Splunk. Strategic narrative belongs to the health board, and a multi-year architecture note has no observables for the night shift. An ES annotation without a matching search creates no notable and is not a search term. Civic analysts should pull IoCs and TTPs from the mixed packet and leave board language for the strategic consumer.