A night-shift analyst sees a 911 CAD notable and immediately pulls the CAD network interface to contain it, skipping analysis. What is wrong with that sequence?
Select an answer to reveal the explanation.
Short Explanation
911 CAD is the city's heartbeat, not a lab PC you unplug for sport. Identify, scope, then analyze—then remediate. Skipping straight to pulling the NIC is out-of-order stages and a self-inflicted outage.
Full Explanation
Splunk's five investigation stages stay in order even on high-availability civic systems: identify, investigate/scope, analyze, remediate, then recover. Skipping analyze to pull a 911 CAD NIC is premature remediation and can take down public-safety availability before the hypothesis is confirmed. CAD telemetry is in scope for Enterprise Security when it is onboarded; it is not exempt from the method. MTTR targets do not authorize skipping evidence review on public-safety hosts.