A library catalog incident is contained. The city wants to close the case and skip everything after remediation. Which work belongs in Splunk's fifth investigation stage?
Select an answer to reveal the explanation.
Short Explanation
Containment is not the last chapter. Recover the catalog, write down what you learned, tune the noisy search, and fix the runbook so the cameras go back to watching. Leaving the catalog down to cook the metrics is not a stage; it is a civic outage.
Full Explanation
The fifth of Splunk's investigation stages is recover and document lessons: restore civic service, capture what the incident taught, tune detections, and update runbooks so continuous monitoring resumes effectively. After a library catalog incident is contained, closing the case without that work leaves patrons without service and leaves the same detection gap open for the next shift. Identifying a new trigger by wiping a second branch library just in case fails by concept because that is unscoped destructive action, not recover, and it creates fresh evidence loss. Skipping recovery and leaving the catalog offline so dwell time looks shorter fails by concept because falsifying metrics and denying library service are not investigation outcomes. Re-opening scoping as if no analysis or remediation had occurred fails by concept because it rewinds the five-stage method instead of completing recover and documentation. Exam caveat: SPLK-5001 treats recover/document as required after remediate; marking a notable Resolved or Closed is incomplete when service, lessons, and monitoring improvements are untouched. Operational check: restore catalog availability with change control, file lessons-learned and detection-tune tickets, update the IR runbook, verify the new or tuned correlation search covers the exploited gap, then close the notable.