A hunt confirms rare dest_port 4444 egress from library kiosks. How should the civic SOC turn that success into continuous monitoring?
Select an answer to reveal the explanation.
Short Explanation
A good hunt that stays in a notebook is a fire drill you never schedule. Promote that 4444 kiosk pattern into an ES correlation or risk rule and the watch becomes continuous. One-off glory does not protect the library overnight.
Full Explanation
Confirmed hypotheses should be converted into Enterprise Security detections or risk rules so the same rare egress is monitored continuously. Analyst scope is promoting the pattern in ES, not authoring SOAR Python first. Leaving the hunt as a notebook or USB export abandons continuous monitoring.