Glossary: Security Operations and Incident Response

Lessons learned

Also written: after-action review, post-mortem

A blameless meeting soon after an incident where everyone involved reviews what happened and agrees on changes, each with an owner and a date. The changes feed back into preparation.