A computer emergency response team is called at midnight to investigate a case in which a mail server was restarted. After an initial investigation, it was discovered that email is being exfiltrated…

In the incident response lifecycle, after initial discovery, the identification phase involves gathering information about the incident, including the source and method of attack. Identifying the source of the active connection is crucial for understanding how the exfiltration is occurring and informing subsequent containment strategies, ensuring effective remediation.

Eradication and recovery are later stages of incident response, performed after identification and containment; attempting them without full understanding can be ineffective or incomplete.

While containment is critical, disconnecting the server immediately without first identifying the connection's source could destroy volatile evidence or prevent full understanding of the attack, hindering comprehensive remediation.

Formatting the server is a drastic measure typically reserved for recovery, which would destroy all forensic evidence vital for investigation and preventing future incidents.