Multiple employees receive an email with a malicious attachment that begins to encrypt their hard drives and mapped shares on their devices when it is opened. The network and security teams perform…

Eradication involves removing the threat from affected systems, such as reimaging devices or deleting malware, which typically occurs before systems are brought back online.

Containment aims to limit the scope and spread of an incident, often by isolating affected systems or shutting down compromised services, which is an earlier phase of the response.

The Recovery phase is focused on bringing systems and services back to their normal operating status after an incident. Re-enabling critical services like network shares, which were shut down for containment, is a primary activity in this phase to restore business operations following eradication of the threat.

Lessons learned is a post-incident activity focused on reviewing the incident, identifying areas for improvement, and updating policies, which occurs after the recovery of systems.