To investigate outbound and inbound traffic to a known C2 IP address, which search approach should you use in SecOps?

• A. SOAR Search to run a playbook that investigates suspicious IP traffic.
• B. SOAR Search to identify cases where the suspicious IP exists.
• C. SIEM Search using src.ip and target.ip to identify outbound and inbound traffic associated with the IP.
• D. SIEM Search against grouped ip field using enriched suspicious events.

Answer: (C)

When you want to see how a known C2 IP is moving traffic to and from your environment, the key is querying the actual network logs with the fields that record who talked to whom. A SIEM search that uses the source IP and the destination (target) IP lets you capture both directions of communication: outbound connections from internal hosts to the C2 IP (internal src.ip to the C2 as target.ip) and inbound connections from the C2 back to internal hosts (C2 as src.ip to the internal as target.ip). This approach gives you a clear timeline of interactions, identifies which assets participated, and shows the volume and timing of the traffic, all essential for understanding infection breadth and persistence.

The other options don’t line up as well with the goal. A SOAR playbook focus is on automated responses and orchestration rather than directly surfacing traffic patterns to a known IP. Searching for cases containing the IP doesn’t reveal actual traffic flows or which hosts were communicating. Relying on a grouped IP field with enriched events may obscure per-session detail and depend on enrichment quality, making it harder to precisely identify inbound versus outbound traffic to the C2 IP.