An analyst is investigating a potential intrusion and needs to determine the timeline of events. Which PICERL phase does this activity fall under?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — determining the timeline of events happens in the Identification phase, where you detect and confirm an incident and figure out what happened and when. Preparation is pre-incident planning, not investigation.
Full Explanation
The Identification phase of PICERL involves detecting and confirming that an incident has occurred, including timeline analysis to understand what happened and when. Preparation is wrong because it involves pre-incident planning, tools, and procedures before an event occurs. Containment is wrong because it involves stopping further damage after an incident is confirmed. Eradication is wrong because it involves removing the threat from the environment after it is identified and contained.