問題文
The team measures how long it takes for someone to start working on a finding. Which record on the finding provides the necessary timestamp, and what does that imply about how the fields should be configured?
選択肢
- The moment the status changes from new to in progress, which means the default status must be set to in progress so the transition is recorded at creation time, which stamps the record at the start.
- The creation time of the associated investigation, which means every finding must be promoted to an investigation immediately even when no investigation is warranted and that promotion step is what writes the pickup time.
- The index time of the finding, which means the detection must use the index time scheduling option so that the creation and the pickup share the same clock on the indexing tier.
- The moment the owner changes from empty to a person, which means the default owner must be left empty so that the act of claiming a finding produces a timestamp.