At 9:15 AM EST, Marcus Wong, a financial operations analyst, contacts the SOC after noticing Excel spreadsheets automatically encrypting with unusual file extensions (e.g., .locked or .crypt). The Tie

At 9:15 AM EST, Marcus Wong, a financial operations analyst, contacts the SOC after noticing Excel spreadsheets automatically encrypting with unusual file extensions (e.g., .locked or .crypt). The Tier 1 analyst logs the incident as ticket #INC-89271 in the SIEM and escalates it to a Tier 2 SOC analyst for investigation. Which phase of the Incident Response process is currently taking place?