A city manager lists Splunk's five investigation stages and puts continuous monitoring as stage one. How should the analyst correct that mix-up?
Select an answer to reveal the explanation.
Short Explanation
The cameras on the street are not a police interview. Continuous monitoring is the always-on watch that hands you a notable so identify can start. It is not one of the five investigation stages, and it does not replace them.
Full Explanation
Continuous monitoring is the ongoing collection, analytics, and alerting layer that produces investigation triggers such as notables on civic indexes. Splunk's five investigation stages begin when a trigger is identified; monitoring feeds stage one (identify) via notables and hunt hits, but continuous monitoring is not itself one of those five stages. Saying continuous monitoring replaces all five stages once dashboards exist fails by concept because dashboards do not retire identify-scope-analyze-remediate-recover when a municipal incident occurs. Calling continuous monitoring stage five fails by concept because stage five is recover and document lessons; monitoring should resume after recover with gaps closed, and it also feeds identify every day. Equating continuous monitoring with notable status In Progress fails by concept because In Progress is Analyst Queue workflow state on a single notable, not the always-on monitoring subsystem. Exam caveat: on SPLK-5001, keep continuous monitoring (the always-on watch) distinct from the five-stage investigative method it feeds. Operational check: show city managers that scheduled correlation searches create notables for identify, then walk the five stages on a sample parks or permitting case without labeling monitoring as stage one or as a workflow status.