The netstat command is a command-line network utility for displaying network connections. The -o parameter is specifically used to display the owning process ID (PID) associated with each active TCP connection. This is crucial for threat intelligence analysts as it allows them to correlate network activity directly with a specific process running on the local machine. By identifying the PID, an analyst can then use other tools, like Task Manager or tasklist, to investigate the process further to determine if it is legitimate or malicious.

A. [-n]: This parameter displays addresses and port numbers in numerical form, preventing DNS or service name lookups, but it does not show the process ID.

B. [-a]: This parameter displays all active connections and listening ports, including both TCP and UDP. It does not, by itself, include the process ID.

D. [-s]: This parameter displays per-protocol statistics (e.g., for TCP, UDP, ICMP, IP). It provides summary information, not details about individual connections like the PID.

1. Microsoft Corporation. (2023). netstat. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat. (This official vendor documentation explicitly states: "-o: Displays the owning process ID associated with each connection.")

2. University of Washington, UW-IT. (n.d.). Commonly used netstat commands. IT Connect. Retrieved from https://itconnect.uw.edu/learn/workshops/online-tutorials/basics-of-computing-and-the-internet/networking-fundamentals/commonly-used-netstat-commands/. (This university courseware notes that netstat -o will "show the process ID number" for the connection.)