An organization had a breach due to a phishing attack. An engineer leads a team through the recovery phase of the incident response process. Which action should be taken during this phase?

Hosting a discovery meeting to define configuration and policy updates is characteristic of the post-incident lessons-learned phase, not the recovery phase.

During recovery, reimaging the affected hosts eliminates any persistent malware or backdoors introduced by the phishing attack, while updating IDS/IPS signatures ensures the environment is hardened against the same threat vector going forward.

Identifying affected systems and tools used to detect the attack belongs to the identification phase, which occurs earlier in the incident response lifecycle.

Capturing traffic with Wireshark and reviewing email filters are analysis and containment activities performed before recovery begins, not during the restoration phase.