An analyst moves a parks notable from New to In Progress to Resolved and tells the shift lead those statuses are Splunk's five investigation stages. What should the lead clarify?
Select an answer to reveal the explanation.
Short Explanation
New, In Progress, Resolved is the ticket's progress bar, not the investigation playbook. You still identify, scope, analyze, remediate, and recover. Status tells the queue where the case sits; the five stages tell you how to work it.
Full Explanation
Enterprise Security notable status values such as New, In Progress, Pending, Resolved, and Closed are workflow state on Incident Review / Analyst Queue. Splunk's five investigation stages are the investigative method: identify, investigate and scope, analyze, remediate, and recover/document. Moving a parks notable through statuses can roughly track progress, but those labels do not replace, rename, or equal the stages. Claiming Resolved is the name of the analyze stage fails by concept because Resolved is workflow completion language, not the evidence-review stage where CIM pivots and contributing events are examined. Saying notable status is unused in Enterprise Security and only dispositions exist fails by concept because both status and disposition are maintained and audited. Treating New, In Progress, and Resolved as MITRE ATT&CK tactics fails by concept because ATT&CK describes adversary goals and techniques, not queue workflow. Exam caveat: SPLK-5001 expects analysts to separate workflow fields from investigative method and from ATT&CK. Operational check: on a parks notable, update status as work proceeds while explicitly naming which investigation stage you are in, keep disposition for analytic outcome, and coach the shift never to teach status labels as the five stages.