The most scalable approach is to include the appropriate standard CIM asset and identity fields in the detection results. Enterprise Security can then use its Assets and Identities framework to recognize those normalized entities and apply available contextual enrichment to the resulting risk activity.
Typical CIM-aligned entity fields include values representing users, source systems, destinations, and devices. Correctly populating these fields enables downstream Enterprise Security functionality to associate detection results with known entities and retrieve attributes such as priority, organizational context, category, ownership, or other maintained asset/identity information.
Option B only addresses identity enrichment, while option C addresses only assets. The requirement explicitly concerns both asset and identity context , making either lookup alone incomplete. Option D is also inappropriate because querying Active Directory directly at detection time is not the standard mechanism for applying the complete ES asset-and-identity context and would introduce unnecessary external dependency and latency.
The larger engineering principle is that detections should output normalized semantic fields rather than manually embedding every possible contextual attribute. Centralized enrichment then remains maintainable as asset and identity information changes.
Study Guide topics: Assets and Identities Framework, CIM normalization, risk events, contextual enrichment, entity fields, detection output design.
