Analysis confirmed a treasurer identity used a public kiosk to reach a listed command-and-control host. When should the analyst disable the account, block that host, or isolate the kiosk?
Select an answer to reveal the explanation.
Short Explanation
Now you have the picture: treasurer, kiosk, listed C2. Remediate is the stage where you disable the account, block the host, or isolate the kiosk. Doing that before analysis is guessing; doing it never is leaving the door open.
Full Explanation
Splunk's fourth investigation stage is remediate, timed after analysis has confirmed what to contain. When analysis shows a treasurer identity used a public kiosk to reach listed command-and-control, disabling the account, blocking that host, or isolating the kiosk belong in remediate—not as the first click and not deferred until recover. Taking those actions as the first click before any notable is identified fails by concept because identify, scope, and analyze have not established what to contain and risk availability and evidence loss. Performing them during recover after the library catalog is restored fails by concept because recover restores service and documents lessons after containment; leaving C2 reachable until then extends dwell. Claiming remediation is only an Engineer change-ticket after the case is Closed fails by concept because analyst-coordinated containment is part of the five-stage method even when engineers execute changes. Exam caveat: remediate follows analysis; civic containment still coordinates with change owners but is not delayed until Closed. Operational check: after documented analysis of treasurer–kiosk–C2, open the containment actions (disable, block, isolate), record who approved them, and only then move toward recover.