A hunt confirms rare dest_port 4444 egress from library kiosks. How should the civic SOC turn that success into continuous monitoring?
Select an answer to reveal the explanation.
Short Explanation
A good hunt that stays in a notebook is a fire drill you never schedule. Promote that 4444 kiosk pattern into an ES correlation or risk rule and the watch becomes continuous. One-off glory does not protect the library overnight.
Full Explanation
Confirmed hypotheses should be converted into Enterprise Security detections or risk rules so the same pattern is monitored continuously instead of living only in a one-off hunt. When a hunt confirms rare dest_port 4444 egress from library kiosks, the civic SOC should promote that confirmed pattern into an ES correlation search or risk rule keyed to library kiosk assets and the rare port behavior. Keeping the hunt as a one-off notebook and never scheduling it abandons continuous monitoring and relies on someone remembering to rerun it. Hand-writing a Python SOAR playbook before any ES detection exists skips the analyst's in-scope promotion path and jumps to sibling-skill automation authoring. Exporting kiosk logs to a USB drive for weekly manual review only is not continuous Splunk monitoring and creates custody and scalability problems. Exam caveat: successful Domain 6.1 hunts close the loop by becoming ES detections or risk rules; SOAR Python authoring is not the first promotion step for the Defense Analyst. Operational check: take the confirmed 4444 kiosk SPL, constrain it to library kiosk Asset and Identity groups, add risk or notable Adaptive Response as appropriate, schedule the correlation or risk rule, and verify a test event surfaces in Incident Review or risk.