In Panorama, which three reports or logs will help identify the inclusion of a host source in a command-and-control (C2) incident? (Choose three.)

To identify a host involved in a command-and-control (C2) incident, an analyst should review logs and reports that specifically track malicious activity. Threat logs record C2 signatures detected by the Anti-Spyware profile. WildFire analysis reports provide detailed behavioral information on malware, including its C2 communication patterns. Botnet reports correlate various threat events, including C2 traffic, to identify infected hosts (bots) on the network and their communication attempts with C2 servers. These three sources provide direct evidence of C2 activity and help pinpoint the compromised host.

A. SaaS reports focus on the usage and risk of sanctioned and unsanctioned SaaS applications, not directly on C2 threat identification.
B. Data filtering logs are used for Data Loss Prevention (DLP) to track the exfiltration of sensitive data, not for detecting C2 communications.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide Version 11.0. "Threat Log". This section details how the threat log records entries for traffic that matches security profiles, including C2 traffic identified by Anti-Spyware signatures.

2. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide Version 11.0. "Botnet Report". This section explains that the report identifies infected hosts by correlating C2 traffic patterns from threat logs and other sources.

3. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide Version 11.0. "WildFire Analysis Reports". This section describes how WildFire reports detail malware behavior, which includes C2 domains, IP addresses, and communication protocols.