When anomalous external-domain communications are detected, which action provides the best single path to assess context?

• A. UDM search for domains with geolocations first seen in last 30 days.
• B. UDM search for low-prevalence domains first seen in last 30 days.
• C. Raw log search for low-prevalence domains first seen in last 30 days.
• D. Identify domains with higher normalized risk in Risk Analytics; drill down to determine prevalence and first-seen.

Answer: (D)

Assessing risk and context of unusual external-domain communications is best done by focusing on a risk-based view that surfaces the most suspicious domains and lets you quickly examine prevalence and first-seen. Using Risk Analytics provides a normalized risk score that combines multiple signals—reputation, threat intel, behavior, and telemetry—so you get a single, prioritized indication of which domains deserve attention. Drilling down on those high-risk domains to check prevalence (how often the domain appears) and first-seen (how recently it appeared) gives you immediate, actionable context about whether the domain is a newly observed threat or something already known but recently seen in your environment. This approach accelerates triage and reduces noise, compared with relying on geolocation alone, scanning for low-prevalence domains, or parsing raw logs without a risk framework.