PICERL - Common incident response process / framework
Incident Response Phases – Containment
Containment is the third phase of the IR Cycle. You investigate what happened and implement measures to stop the attack spreading or doing more harm than you are prepared to accept.