When an incident hits, improvising costs time you don't have. The SANS PICERL lifecycle (aligned with NIST 800-61) gives you a repeatable spine.
The six stages
- Preparation - the work you do before: logging, backups, playbooks, access. Most incidents are won or lost here.
- Identification - confirm it's a real incident, and scope it: what, where, since when.
- Containment - stop the bleeding. Short-term (isolate the host, revoke sessions) then long-term (rebuild clean, block the vector). Contain reversibly and fast.
- Eradication - remove the foothold: malware, persistence, attacker accounts. If you skip this, you get re-owned.
- Recovery - restore systems from clean backups and monitor closely for the attacker's return.
- Lessons learned - the step everyone skips and everyone needs. What let this happen, and what detection/control stops the next one?
Two rules that save incidents
- Contain before you investigate deeply on active, high-impact events (ransomware, active C2) - but never destroy evidence you'll need (don't reimage before you've scoped).
- Order matters: eradicate then recover. Restoring into an uncleaned environment just restarts the incident.