A county SOC has scoped a treasurer-account notable to one user and a four-hour window. Leadership wants the account disabled before anyone looks at contributing events. What belongs in Splunk's third investigation stage first?
Select an answer to reveal the explanation.
Short Explanation
Scoping told you which desk and which hours. Analyze is where you actually read the evidence—CIM pivots and contributing events—before anyone yanks the treasurer's login. A notable is a hypothesis, not a guilty verdict.
Full Explanation
Splunk's third investigation stage is analyze: use Enterprise Security evidence such as CIM-normalized fields and contributing events to confirm or refute the hypothesis formed during scoping. Disabling accounts and restoring from backup are remediation or recovery actions that should follow analysis, especially on a civic finance identity. Treating the mere existence of a notable as proof skips that evidence review. Analysis-first reduces both missed true activity and availability damage from premature containment.