Night shift has not finished scoping a wastewater-plant notable. A supervisor wants it labeled True Positive so the queue looks clear at dawn. What should the analyst do?
Select an answer to reveal the explanation.
Short Explanation
An empty queue at dawn is not the same as a finished investigation. If scoping is not done, disposition stays Undetermined and status stays In Progress. Guessing True Positive to look productive is rubber-stamping.
Full Explanation
If night shift has not finished scoping a wastewater-plant notable, disposition should remain Undetermined with status In Progress until analysis supports a final label. Clearing the queue with a premature True Positive for dawn optics falsifies the analytic outcome and misleads the day shift about plant risk. Assigning True Positive - Suspicious Activity to clear the queue then scoping later fails by concept because disposition must follow evidence, not supervisor preference for an empty board. Assigning False Positive - Incorrect Analytic Logic because scoping is taking too long fails by concept because investigation duration is not proof the analytic is wrong. Setting status Closed and skipping disposition because wastewater is believed air-gapped fails by concept because air-gap claims do not remove Enterprise Security workflow requirements when a notable already exists. Exam caveat: SPLK-5001 accepts Undetermined while work continues; supervisors must not force final dispositions for queue cosmetics on OT-adjacent civic systems. Operational check: keep status In Progress, disposition Undetermined, record scoping progress in notable comments or a case notebook, and set a final disposition only after analyze supports it.