Which incidence response step includes identifying all hosts affected by an attack?

During the detection and analysis phase, security teams investigate an identified incident to understand its full scope, nature, and impact. This process includes thoroughly identifying all systems, applications, data, and users that have been compromised or affected by the attack to inform subsequent response actions.

Post-incident activity involves lessons learned, reporting, and evidence retention *after* the incident has been resolved.

Preparation involves activities conducted *before* an incident occurs, such as planning, training, and setting up tools and procedures.

Containment, eradication, and recovery focus on limiting the damage, removing the threat, and restoring services, which occur *after* the scope and affected hosts have been identified through analysis.