The network operations center has identified malware, created a ticket within their ticketing system, and assigned the case to the SOC with high-level information. A SOC analyst was able to stop the…

Stopping the malware from spreading represents the completion of the containment step, and identifying the attacking host is the conclusion of detection and analysis. The next sequential phase in the NIST IR lifecycle is eradication - removing the malware and its artifacts from all affected systems - followed by recovery, which restores systems to normal verified operation.

Post-incident activity, including lessons-learned reviews and report generation, occurs only after eradication and recovery have fully concluded.

Containment was already accomplished when the SOC stopped the malware from spreading; repeating it would be redundant and delay remediation.

Detection and analysis was completed when the malware was identified and the attacking host was found; the incident has already moved past this phase.