County Asset and Identity records mark wastewater jump hosts as should_update, but endpoint telemetry has not reported a patch cycle in 45 days. What hunt technique should the civic SOC apply first?
Select an answer to reveal the explanation.
Short Explanation
Missing patch reports are like fleet trucks that never check in at the barn—you hunt the paperwork gap, not a monster in the woods. Join Asset and Identity should_update hosts with empty patch telemetry and you are hunting configuration drift. A hash match can wait; the silent jump host is the civic finding.
Full Explanation
Configuration hunting looks for insecure or unexpected host state, not a known indicator. Asset and Identity should_update flags plus absent endpoint patch telemetry is a compliance-drift hypothesis that Splunk can test with CIM endpoint and A&I lookups. Isolating the plant, waiting for malware hashes, or rebuilding data-model acceleration does not answer whether those civic jump hosts drifted off the patch baseline.