• Detection and analysis - The detection and analysis phase in your CSIRP is triggered when an incident has just occurred
  • Containment, eradication, and recovery - this phase is the heart of your CSIRP
  • Post-incident activities - after the incident has been stopped, security updates have been made