الطلب
“Draw an intrusion containment process: an intrusion is detected and triaged, false positives close, true positives are assessed for severity, urgent incidents isolate affected hosts, block malicious IPs, eradicate the threat, restore systems, and resolve; non-urgent incidents are monitored and analysed before resolution.”
جرّب إذنAdd evidence preservation before isolation.Add an incident report after restoration.
ما الذي يتضمنه هذا الرسم
اقرأ القرارات الكامنة وراءه.
01Alert triage
true positive or false positive
02
Whether immediate containment is necessary based on severity
Use in Security Operations Centers (SOCs) for standard network intrusion response procedures.