After identifying a notable on a county permitting host, the analyst's next move is to reimage every PC in the department. Which Splunk investigation stage should come next instead?
Select an answer to reveal the explanation.
Short Explanation
Identifying the alarm is not the same as knowing which rooms are smoky. Next up is investigate and scope: which hosts, which users, which hours. Reimaging the whole permitting floor is a later decision, and it is a terrible first guess.
Full Explanation
After identify, Splunk's second investigation stage is investigate and scope: who, what, and when. On a county permitting notable that means bounding hosts, identities, and the time window before any mass reimage. Recovery from tape and after-action writing belong at the end of the sequence. Closing the notable because a reimage is planned skips scoping, analysis, and evidence-based containment.