An analyst moves a parks notable from New to In Progress to Resolved and tells the shift lead those statuses are Splunk's five investigation stages. What should the lead clarify?
Select an answer to reveal the explanation.
Short Explanation
New, In Progress, Resolved is the ticket's progress bar, not the investigation playbook. You still identify, scope, analyze, remediate, and recover. Status tells the queue where the case sits; the five stages tell you how to work it.
Full Explanation
Enterprise Security notable status (New, In Progress, Pending, Resolved, Closed) is workflow state on the Analyst Queue. Splunk's five investigation stages are the method: identify, investigate/scope, analyze, remediate, recover/document. Moving status can roughly track progress, but Resolved is not analyze and the status list is not a substitute for naming the stages. Status and disposition remain separate from MITRE ATT&CK tactics.