A clerk-account risk notable is in the city queue. What is the intended sequence using the notable, contributing events, and SPL together?
Select an answer to reveal the explanation.
Short Explanation
Open the case, read the receipt, then go look for more. That is notable, then contributing events, then SPL on src. Skipping the notable or wiping the PC first is backwards.
Full Explanation
The intended civic investigation sequence for a clerk-account risk notable is open the notable, expand contributing events, then write follow-up SPL against src (or the entity) to deepen the story. That uses the Enterprise Security case spine before wide ad-hoc search and before destructive response. Writing SPL first, skipping the notable, then inventing contributing events in a spreadsheet fails by concept because it abandons ES tracking and fabricates the scored trail outside the product of record. Closing the notable as False Positive before reading contributing events fails by concept because disposition without evidence review is premature and may hide a true clerk-account compromise pattern. Reimaging the clerk PC, then opening the notable fails by concept because remediate-before-identify destroys evidence and inverts Splunk's investigation stages. Exam caveat: SPLK-5001 emphasizes notable → contributing events → SPL as the analyst path for risk-driven municipal cases. Operational check: open the clerk-account risk notable on Analyst Queue, expand contributing events, run time-bounded SPL on src or user for additional activity, then decide disposition and remediation from that combined evidence—not from wipe-first instincts.