A case contains a file hash enriched with VirusTotal context and categorized as likely malicious. You need to quickly identify devices and users in your org who interacted with this file. What should you do?

• A. Playbook to perform a UDM search matching the file hash in SecOps SIEM.
• B. Playbook to query TIP for presence of file hash.
• C. Manual action in SOAR to perform UDM search.
• D. Manual action in SOAR to query TIP.

Answer: (A)

The key idea is to quickly map the indicator to people and machines in your environment by querying the centralized telemetry in your SIEM. When a file hash is enriched as likely malicious, the fastest way to see who and what interacted with that file is to run a playbook that performs a UDM search in the SecOps SIEM, using the hash as the search criterion. The Unified Data Model unifies data from endpoints, networks, and applications, so the search returns all relevant events where the file hash appeared—discovering which devices and which users touched it, along with timestamps and maybe related processes. This gives you a concrete, actionable view of impact and containment scope in one automated step.

Relying solely on Threat Intelligence Platform data would tell you about the hash’s reputation, not about actual in-environment interactions. Manual actions in SOAR could work, but they’re slower and less repeatable than a targeted UDM-based playbook that automates the lookup and returns a ready-to-use list of affected entities.