To quickly reduce noise when detecting requests to potentially malicious domains from NDR logs, which approach is most appropriate?

• A. Ingest domain monitoring service logs and build a multi-event correlation.
• B. Build a SOAR playbook that enriches domains with VirusTotal and auto-closes benign.
• C. Build a multi-event rule correlating NDR domains with WHOIS context in entity graph and set risk based on domain creation time.
• D. Ingest TIP logs and build a multi-event rule correlating NDR domains with your threat intelligence data.

Answer: (D)

Leveraging threat intelligence feeds to filter NDR-detected domain requests is the fastest way to cut noise. By ingesting TIP logs and building a multi-event correlation between each NDR domain request and your threat intel data, you can quickly distinguish known malicious domains from the rest. When a request matches a known indicator, you can elevate or block it; otherwise, it can be deprioritized, dramatically reducing false positives without waiting on slower, more manual checks.

Other approaches lack that combined speed and certainty: just ingesting domain-monitoring logs without TI context provides less immediate signal to separate benign from malicious; enriching with VirusTotal and auto-closing benign depends on external checks that can lag and may misclassify edge cases; using WHOIS context and domain creation time adds some value but isn’t timely for current malicious activity and won’t scale as effectively for rapid noise reduction.