A library catalog incident is contained. The city wants to close the case and skip everything after remediation. Which work belongs in Splunk's fifth investigation stage?
Select an answer to reveal the explanation.
Short Explanation
Containment is not the last chapter. Recover the catalog, write down what you learned, tune the noisy search, and fix the runbook so the cameras go back to watching. Leaving the catalog down to cook the metrics is not a stage; it is a civic outage.
Full Explanation
The fifth of Splunk's investigation stages is recover and document lessons: restore civic service, capture what the incident taught, and improve detection or process. For a library catalog that includes bringing the service back, tuning a noisy correlation search, and updating the runbook so continuous monitoring resumes with coverage. Wiping another branch or re-scoping from zero is not recover. Leaving service offline to improve a dwell or MTTR chart undermines the purpose of the stage.