Incident Response

When to Activate

• Active security incident requiring investigation
• Memory forensics and artifact extraction
• Disk forensics and timeline reconstruction
• Malware containment and eradication
• Post-incident analysis and reporting

IR Phases