Containment and Eradication

Containment aims to limit the impact of the incident, while eradication involves removing the threat and preventing recurrence:

1. Isolation: Isolating affected systems and blocking malicious activities to prevent further damage.
2. Root Cause Analysis: Identifying the root cause of the incident and removing malicious components from systems.