Process and analysis
What is Incident response?
The organised process of detecting, containing, investigating and recovering from a security incident, then learning from it.
Incident response is the structured way an organisation handles a security incident. Common frameworks, such as NIST's, describe phases of preparation, detection and analysis, containment, eradication and recovery, and post-incident review.
Threat intelligence supports every phase: it helps recognise what kind of attack is under way, what the actor usually does next, which indicators to search for and when it is safe to say the attacker is gone.