When leveraging a MISP feed to detect Command-and-Control domain indicators in the entity graph, which of the following entity settings should you apply to filter for domain IOCs?

• A. $ioc.graph.metadata.entity_type = "DOMAIN_NAME" and $ioc.graph.metadata.source_type = "ENTITY_CONTEXT"
• B. Same entity_type and DERIVED_CONTEXT
• C. Same entity_type and GLOBAL_CONTEXT
• D. Same entity_type and SOURCE_TYPE_UNSPECIFIED

Answer: (A)

The key is to filter for the exact kind of indicator you want and its source context. By using entity_type set to DOMAIN_NAME you restrict the graph to domain indicators, ensuring you’re looking at actual domain IOCs rather than other types like IPs or hashes. Pairing that with source_type set to ENTITY_CONTEXT ensures those domain IOCs come from concrete MISP entities, not from derived inferences or global aggregates. This combination yields a precise, relevant set of C2 domain indicators for your graph analysis.

Using derived or global context would bring in domains inferred from other data or from broad, non-entity sources, which can add noise or reduce reliability. Unspecified source type wouldn’t constrain the data appropriately, making the results less targeted.