7 terms
Containment in incident response is the phase that limits how far an attack spreads and how much damage it causes while evidence is preserved.
Digital forensics is the disciplined collection, preservation and analysis of digital evidence to reconstruct what happened during a security incident.
An incident response plan (IRP) is a documented, approved guide that defines how an organization detects, handles and recovers from security incidents.
Incident triage is the rapid assessment of security alerts that decides whether an incident exists, how severe it is and who responds first.
An IOC (indicator of compromise) is an observable artifact, such as a file hash, domain or IP address, showing that a system may have been breached.
A security playbook is a documented, step-by-step procedure for handling one specific type of security incident, from detection through recovery.
Threat hunting is the proactive, hypothesis-driven search for attackers already inside a network who have evaded automated security alerts.