An incident is not a feeling. It is a declared state with an owner, a severity and a plan. The phases give you a shared map when everything is moving at once.
The lifecycle
- Preparation — playbooks, contacts, access, backups, logging.
- Identification — confirm whether an event is an incident and set severity.
- Containment — stop the spread while preserving evidence.
- Eradication — remove the cause and the attacker's footholds.
- Recovery — restore services and verify they are trustworthy.
- Lessons learned — turn findings into assigned changes.
The phases are not always linear. New evidence can send you back to identification; a second foothold can force another containment round.
Event or incident?
An event is any observable occurrence. An incident is an event, or series of events, with actual or potential harm that requires a coordinated response.
A failed login is an event. A successful login from a new country followed by a mailbox rule and a password change is an incident until proven otherwise.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.