Q88
Single choice
An analyst has noticed unusual activities in the SIEM to a .cn domain name.
Which of the following should the analyst use to identify the content of the traffic?