An analyst is investigating a potential intrusion and needs to determine the timeline of events. Which PICERL phase does this activity fall under?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — b is correct because the Identification phase of PICERL involves detecting and confirming that an incident has occurred, including timeline analysis to understand what happened and when. A is wrong because Preparation involves pre-incident planning, tools, and procedures before an event occurs.
Full Explanation
B is correct because the Identification phase of PICERL involves detecting and confirming that an incident has occurred, including timeline analysis to understand what happened and when. A is wrong because Preparation involves pre-incident planning, tools, and procedures before an event occurs. C is wrong because Containment involves stopping further damage after an incident is confirmed. D is wrong because Eradication involves removing the threat from the environment after it is identified and contained.