SPLK-3001 Exam - Question 14

In the context of an investigation, the best way to store a newly-found Indicator of Compromise (IOC) is to use a method that ensures it is properly catalogued and easily accessible for further analysis and tracking. While options like pasting it into Notepad or adding it in a text note might temporarily store the IOC, these methods lack the organization and structure needed in a rigorous investigative process. The option to 'Click the Add Artifact button' is most appropriate because an artifact repository is specifically designed to store, organize, and manage IOCs along with relevant metadata, which is crucial for thorough investigation and correlation with other data.