A city manager lists Splunk's five investigation stages and puts continuous monitoring as stage one. How should the analyst correct that mix-up?
Select an answer to reveal the explanation.
Short Explanation
The cameras on the street are not a police interview. Continuous monitoring is the always-on watch that hands you a notable so identify can start. It is not one of the five investigation stages, and it does not replace them.
Full Explanation
Continuous monitoring is the ongoing collection, analytics, and alerting layer that produces investigation triggers such as notables. Splunk's five investigation stages begin when a trigger is identified; monitoring is the feed, not stage one of that sequence. Dashboards do not retire identify-scope-analyze-remediate-recover. Notable workflow status is a queue field, not a synonym for continuous monitoring.