A malware outbreak is detected by the SIEM and is confirmed as a true positive.

The first action for an incident response team following the detection of a malware outbreak is to isolate critical hosts from the network. This containment strategy is crucial to prevent the spread of the malware to other parts of the network and to minimize the impact while the team works on eradicating the threat and recovering from the incident4.