A malware outbreak is detected by the SIEM and is confirmed as a true positive. The incident response team follows the playbook to mitigate the threat. What is the first action for the incident…

Assessing the network for unexpected behavior is part of the detection and analysis phase, which has already concluded since the SIEM confirmed a true positive before this step.

Isolating critical hosts from the network is the first containment action because it immediately stops the malware from communicating with command-and-control infrastructure, spreading laterally to other hosts, or exfiltrating data. NIST SP 800-61 and standard IR playbooks place containment as the first active step after identification is confirmed, because all subsequent actions - analysis, patching, and recovery - are undermined if the threat continues to propagate freely.

Patching vulnerabilities is a remediation and recovery activity that occurs after the threat is contained, not as the immediate first action during an active outbreak.

Performing risk-factor analysis is a preparation and planning activity, not an operational response step taken during an active confirmed incident.