What is the goal of the containment phase of incident handling?

Monitoring the attacker to gather intelligence may occasionally occur during containment but is not its primary goal; it more closely describes activities in the identification or threat-hunting phases.

Analyzing systems to determine whether an incident occurred is the objective of the identification phase, which precedes containment.

Containment is specifically designed to stop the attacker from moving laterally, escalating privileges, or damaging additional assets while the organization prepares for eradication. Actions such as isolating affected hosts, blocking malicious network traffic, and disabling compromised accounts are all containment strategies aimed at bounding the incident's scope.

Removing attacker artifacts such as malware and backdoors is the goal of the eradication phase, which follows containment.