The correct collection is service_intel . Splunk Enterprise Security ' s Threat Intelligence Framework separates indicators into intelligence collections according to the type of observable being represented. Fully Qualified Domain Names are service-oriented network identifiers and are handled through the service intelligence collection in the context tested by this question.
This classification matters because the Threat Intelligence Framework must know which event fields and indicator types can be meaningfully compared. A domain such as malicious.example.com is semantically different from a raw IPv4/IPv6 address, a certificate fingerprint, or a complete HTTP URL. The ip_intel collection is intended for IP-oriented indicators, while certificate_intel deals with certificate-related intelligence. http_intel is associated with HTTP-oriented indicators such as URLs and related HTTP observables rather than the standalone FQDN type being asked about here.
Detection engineering depends on this normalization because matching searches must compare compatible indicator types. Correct placement also supports deduplication, expiration, weighting, threat matching, and downstream enrichment of security findings.
Study Guide topics: Threat Intelligence Framework, KV Store collections, indicator normalization, FQDN intelligence, threat matching, intelligence enrichment.
