A county SOC has scoped a treasurer-account notable to one user and a four-hour window. Leadership wants the account disabled before anyone looks at contributing events. What belongs in Splunk's third investigation stage first?
Select an answer to reveal the explanation.
Short Explanation
Scoping told you which desk and which hours. Analyze is where you actually read the evidence—CIM pivots and contributing events—before anyone yanks the treasurer's login. A notable is a hypothesis, not a guilty verdict.
Full Explanation
Splunk's third investigation stage is analyze: use Enterprise Security evidence—CIM-normalized fields, contributing events, and related searches—to confirm or refute the hypothesis formed during scoping. With a treasurer-account notable already scoped to one user and a four-hour window, analysis means reading those events before anyone disables accounts. Disabling every finance account in Active Directory as blanket containment fails by concept because that is premature remediate-stage action that can halt civic finance operations without confirming malice. Declaring the hypothesis proven because a notable exists fails by concept because a notable is a trigger, not proof; analysis must still confirm or refute. Restoring the treasurer workstation from backup before looking at the events fails by concept because recover is stage five and can destroy forensic value if done before analysis. Exam caveat: SPLK-5001 places analyze after scope and before remediate; leadership urgency does not authorize skipping evidence review on civic finance identities. Operational check: open contributing events and CIM pivots for the treasurer identity in the scoped window, document confirm/refute notes, then only escalate containment that matches confirmed findings.