During an incident investigation, which UDM search field best captures network activity tied to rarely seen commands?

• A. product_event_type (antimalware/endpoint events)
• B. principal.ip (network traffic where principal is rarely seen)
• C. principal.user.userid (unexpected sign-on users)
• D. metadata.event_type (process launches and rarely seen commands)

Answer: (D)

This question focuses on how to find events that show a command being run and then connect that to later network activity. To capture activity tied to rarely seen commands, you want the event-category field that records what kind of action actually occurred on the host. metadata.event_type is the best fit because it directly describes the event type, including process launches and other command executions. By querying for process_launch or related command events in this field, you identify when a rarely seen command begins, which you can then correlate with any network activity that follows or accompanies that process.

The other fields focus on different signals. product_event_type covers product-specific alerts like antimalware events, which isn’t about the command execution itself. principal.ip looks at the source IP involved in network traffic, which may help locational or traffic pattern analysis but doesn’t tell you what command was run. principal.user.userid tracks user sign-ons, which is useful for user activity but not the actual command execution or its immediate network consequences. Therefore, metadata.event_type best ties together the rare command execution with its network context.