County Asset and Identity records mark wastewater jump hosts as should_update, but endpoint telemetry has not reported a patch cycle in 45 days. What hunt technique should the civic SOC apply first?
Select an answer to reveal the explanation.
Short Explanation
Missing patch reports are like fleet trucks that never check in at the barn—you hunt the paperwork gap, not a monster in the woods. Join Asset and Identity should_update hosts with empty patch telemetry and you are hunting configuration drift. A hash match can wait; the silent jump host is the civic finding.
Full Explanation
Configuration hunting looks for insecure or unexpected host state and compliance drift, not a known malware indicator. When county Asset and Identity records mark wastewater jump hosts as should_update but endpoint telemetry has not reported a patch cycle in 45 days, the first civic hunt should join those A&I should_update assets with missing patch or update telemetry to test a compliance-drift hypothesis. That join uses CIM endpoint fields and A&I lookups the SOC already maintains and answers whether jump hosts drifted off the patch baseline. Treating every missing report as confirmed ransomware and isolating the entire plant jumps to destructive containment without validating configuration drift and can take wastewater operations offline. Waiting for a matching malware hash before investigating unpatched jump hosts ignores that configuration hunts do not require IoCs. Rebuilding Enterprise Security data-model acceleration as the first hunting step is platform maintenance, not a hunt for should_update drift. Exam caveat: A&I flags such as should_update are hunt inputs for configuration and compliance questions; they are not automatic ransomware verdicts. Operational check: export or lookup wastewater assets with should_update, search endpoint patch or update reporting for those hosts over 45-plus days, list hosts with no recent cycle, and escalate the drift list for patching before any isolation decision.