incident response

The organized process of handling a security incident after it is found: containing it, collecting evidence, removing the threat and recovering systems. Whoever spots an attack first takes the first steps, such as isolating a host or disabling an account, then hands over to incident response for the full investigation.

Where the book teaches it

Chapter 1: Indicators of compromise
Chapter 2: Malware I: viruses, worms, trojans, ransomware
Chapter 10: Reading the evidence
Chapter 13: What's next