Analysis confirmed a treasurer identity used a public kiosk to reach a listed command-and-control host. When should the analyst disable the account, block that host, or isolate the kiosk?
Select an answer to reveal the explanation.
Short Explanation
Now you have the picture: treasurer, kiosk, listed C2. Remediate is the stage where you disable the account, block the host, or isolate the kiosk. Doing that before analysis is guessing; doing it never is leaving the door open.
Full Explanation
Splunk's fourth investigation stage is remediate, and it is timed after analysis has confirmed what to contain. Disabling the treasurer account, blocking the C2, or isolating the kiosk are typical civic containment actions in that stage. They are not the first click of identify, and they are not delayed until recover. Analysts still coordinate with change owners, but waiting until the notable is Closed is not how the five-stage method sequences containment.