A responder needs to categorize an incident based on the high-level goals of the attacker.

Explore, Keep Access, Gain Access, Falcon Detection Method, Contact Controlled systems, Follow Through

Reconnaissance, Delivery, Weaponization, Exploitation, Installation, Command and Control

Identify, Protect, Detect, Respond, Recover, Lessons Learned

Triage, Containment, Remediation, Eradication, Reporting, Recovery