# Phase 1 & 2: Preparation and Identification

The most widely adopted Incident Response framework is the **PICERL** methodology, defined by SANS. It stands for Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.

## 1. Preparation
*"You don't want your first time figuring out how to block an IP address to be during a ransomware attack at 3:00 AM."*

Preparation is everything done *before* an attack happens. It is the most critical phase.
*   **Creating the Team:** Establishing the Computer Security Incident Response Team (CSIRT). Knowing exactly who to call (external forensics, legal counsel, PR firm).
*   **Infrastructure Setup:** Deploying Endpoint Detection and Response (EDR) agents, configuring central logging (SIEM), and ensuring network segmentation.
*   **Playbooks:** Writing step-by-step guides for handling specific incidents (e.g., "Ransomware Playbook", "Phishing Playbook").
*   **Tabletop Exercises:** Conducting simulated cyber attack drills with executives and technical teams to practice the response.

## 2. Identification
Identification is the process of determining whether an event is actually a security incident, and if so, determining its scope.

*   **Events vs. Incidents:** An *Event* is anything that happens on a network (a user logging in, a firewall blocking a packet). An *Incident* is a violation of security policy (a user logging in *from Russia using stolen credentials*).
*   **Indicators of Compromise (IoCs):** Analysts use IoCs to identify bad activity. These are technical artifacts like malicious IPs, domains, or file hashes.
*   **Alert Triage:** SOC analysts review alerts from the SIEM. If an alert is deemed a true positive, the Incident Response process officially begins.
*   **Scoping:** Answering the crucial question: *"How bad is it?"* Did the attacker compromise one laptop, or the entire Active Directory domain controller database? You cannot contain an incident if you do not know the full scope.