Advanced level · Module 3: Incident Response and Digital Evidence · Lesson 2 of 4
Triage, Containment and Eradication
Handle an incident from first report to removal of the threat.
In this lesson you will
- Triage and classify incidents
- Contain and eradicate threats safely
Key concepts
triageseveritycontainmenteradication and recovery
The lesson
Triage confirms whether an event is an incident, how severe it is and what is affected.
Containment limits damage — disabling a compromised account, isolating a device — while preserving evidence. Eradication removes the cause: malware, attacker access, the exploited weakness.
Recovery restores normal operation from trusted sources and watches closely for the attacker's return.
Step by step
- Triage a reported event.
- Choose containment actions.
- Plan eradication.
- Plan recovery and monitoring.
Practice activity
Handle the business email compromise scenario on paper from triage to recovery.
Expected result: A logged, ordered response with justified decisions.
Check your understanding
-
What is the goal of containment?
Show answer
To limit damage while preserving evidence.
-
What must eradication remove besides malware?
Show answer
The attacker's access and the exploited weakness.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.