An analyst is investigating a potential intrusion and needs to determine the timeline of events. Which PICERL phase does this activity fall under?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the Identification phase of PICERL involves detecting and confirming that an incident has occurred, including timeline analysis to understand what happened and when. A is wrong because Preparation involves pre-incident planning, tools, and procedures before an event occurs.
Full explanation below image
Full Explanation
B is correct because the Identification phase of PICERL involves detecting and confirming that an incident has occurred, including timeline analysis to understand what happened and when. A is wrong because Preparation involves pre-incident planning, tools, and procedures before an event occurs. C is wrong because Containment involves stopping further damage after an incident is confirmed. D is wrong because Eradication involves removing the threat from the environment after it is identified and contained.