A clerk workstation is ticketed as slow, and a matching notable is already in the Analyst Queue. The night analyst starts by wiping the PC. What should have been the first of Splunk's five investigation stages?
Select an answer to reveal the explanation.
Short Explanation
You do not throw out the clerk's PC before you know what set the fire alarm off. First stage is identify the trigger: the notable, the help-desk call, or the hunt hit. Wipe-first is jumping to remediate with no idea what you are remediating.
Full Explanation
Splunk's five basic investigation stages begin by identifying the trigger and the question it poses. A notable on the Analyst Queue, a help-desk ticket, or a hunt hit are typical civic triggers; wiping a clerk PC is a remediation action that belongs later and can destroy evidence. Recover and lessons-learned close the loop after analysis and containment. Starting at identify keeps the rest of the method honest.