An analyst opens a notable for a parks workstation and wants Adaptive Response during the analyze stage. Which ad-hoc use is appropriate first?
Select an answer to reveal the explanation.
Short Explanation
First clicks on a notable should be looking through binoculars—ping, nslookup, nbtstat—not swinging a wrecking ball. Enrich during analyze. Wipe and disable are later, after you know what you are hitting.
Full Explanation
Ad-hoc Adaptive Response during the analyze stage is primarily for enrichment actions that gather context from a notable before any destructive decision. On a parks workstation notable, the appropriate first AR use is enrichment such as ping, nslookup, or nbtstat to resolve reachability and naming, not containment. Immediately wiping the workstation as the first Adaptive Response click destroys forensic value and can remove a parks endpoint from service without confirming compromise. Disabling the parks director account before resolving the host name confuses identity containment with host analysis and may interrupt leadership without evidence. Rebuilding the indexer cluster from the notable menu is ES Admin platform work and is not an analyst Adaptive Response on a parks notable. Exam caveat: analyze-stage AR starts with enrichment; destructive actions require higher confidence and often approval, and platform rebuilds are out of analyst AR scope. Operational check: from the parks notable, run ping/nslookup/nbtstat (or equivalent enrichment actions), record results in the investigation, then decide whether containment or account actions are justified—never wipe or disable as the first click.