D3FEND — Restore

When to Use

• Restoring user access after incident containment (reissue credentials, unlock accounts)
• Recovering files, databases, and configurations from backup
• Rebuilding systems from disk images or clean baselines
• Restoring email and software after malware removal
• Validating restored systems before returning to production
• Documenting recovery actions for post-incident review

When NOT to Use

• Active incident containment or eviction → d3fend-evict
• Detection engineering or monitoring → d3fend-detect
• Hardening to prevent future incidents → d3fend-harden
• Backup strategy design → infrastructure-engineer
• Business continuity planning → cybersecurity