Glossary: Security Monitoring and Automation

incident response

The work after an attack is confirmed: containing it, keeping evidence and recovering. Alex's conclusion hands over to incident response, which changes admin's password and blocks the address.