Incident Response Lifecycle

The IR lifecycle (NIST 800-61) has four phases: Preparation; Detection & Analysis; Containment, Eradication & Recovery; and Post-Incident Activity.

Preparation is where battles are won: runbooks, contact trees, backups, and logging in place before the incident. You cannot investigate logs you never collected.

Containment can be short-term (isolate the host) or long-term (rebuild cleanly). Resist the urge to pull the plug instantly — you may destroy volatile evidence in memory. Capture first, then contain, when safe.

The post-incident review is non-negotiable and blameless. The output is concrete: new detections, closed gaps, and updated runbooks. An incident you do not learn from will simply recur.