The incident response team receives information about the abnormal behavior of a host.

After the incident response team has collected and documented all the necessary evidence from the computing resource, the next step is to isolate the infected host from the rest of the subnet. This action is crucial to prevent the spread of the malicious file to other systems on the network. Isolation ensures that the threat is contained and does not propagate, which is a key priority in incident response. Once the host is isolated, further steps such as risk assessment, installation of malware prevention software, and analysis of network traffic can be conducted in a controlled and secure manner