In SecOps, which approach would you use to identify all assets touched by a particular user within a given timeframe?

• A. Use Raw Log Scan view to group events by asset ID.
• B. Query for hostnames in UDM Search and filter results by user.
• C. Generate an ingestion report for sources where the user appeared.
• D. Run a retrohunt to find rule matches triggered by the user.

Answer: (B)

When you need to know every asset a specific user touched in a given window, you want a query that directly links user activity to the assets involved. Querying hostnames in UDM Search and then filtering by the user does exactly that. The UDM aggregates data across sources, so the hostname represents an asset and filtering by the user and timeframe yields all the hostnames (assets) the user interacted with within that period. This approach is efficient, scalable across data sources, and gives you a clear list of assets tied to the user's activity.

The other options don’t fit as well. Raw Log Scan grouped by asset ID relies on raw events and isn’t easily filtered to reflect a single user’s activity across multiple assets within a timeframe. An ingestion report shows where data came from rather than which assets a given user touched. A retrohunt targets historical rule matches for threat hunting, not a complete enumeration of assets touched by a user.