A clerk workstation is ticketed as slow, and a matching notable is already in the Analyst Queue. The night analyst starts by wiping the PC. What should have been the first of Splunk's five investigation stages?
Select an answer to reveal the explanation.
Short Explanation
You do not throw out the clerk's PC before you know what set the fire alarm off. First stage is identify the trigger: the notable, the help-desk call, or the hunt hit. Wipe-first is jumping to remediate with no idea what you are remediating.
Full Explanation
Splunk's five basic investigation stages begin with identify: name the trigger and the question it poses before any destructive action. For a slow clerk workstation that already has a matching notable on the Analyst Queue, the trigger is that notable (and related help-desk context); wiping the PC first destroys evidence and skips identify. Remediating by reimaging every clerk PC in the department fails by concept because mass containment is a later remediate-stage action and is premature before the trigger and scope are known. Recovering the clerk's mailbox from backup as the opening move fails by concept because recover is the fifth stage and assumes remediation and analysis already occurred. Documenting lessons learned before any trigger is named fails by concept because lessons belong after recover, not before identify. Exam caveat: on SPLK-5001, identify is stage one; destructive or recovery actions are not substitutes for naming the notable, hunt hit, or ticket that started the case. Operational check: open the Analyst Queue item, record the notable title, time, and urgency as the trigger, preserve the clerk host for collection, and only then proceed to scope—do not image or wipe until identify and later stages justify it.