An analyst opens a notable for a parks workstation and wants Adaptive Response during the analyze stage. Which ad-hoc use is appropriate first?
Select an answer to reveal the explanation.
Short Explanation
First clicks on a notable should be looking through binoculars—ping, nslookup, nbtstat—not swinging a wrecking ball. Enrich during analyze. Wipe and disable are later, after you know what you are hitting.
Full Explanation
Ad-hoc Adaptive Response during analysis is for enrichment actions such as ping, nslookup, and nbtstat that gather context from a parks notable. Destructive actions are not the first click. Indexer-cluster rebuilds are ES admin work and are not an analyst AR from a notable.