An analyst receives an alert that a user clicked on a malicious link.

The analyst completed substantial analysis by validating the URL, confirming its credential-harvesting purpose, and establishing that the user accessed the malicious site. However, the investigation was closed without performing adequate containment . Even though there is no evidence that stolen credentials were subsequently used, the user's authentication material must be considered potentially exposed because the phishing site was specifically designed to collect credentials.

Containment should reduce the immediate opportunity for an attacker to exploit that exposure. Appropriate measures can include resetting the affected password, revoking active authentication sessions or tokens, temporarily restricting the account when warranted, blocking the malicious URL or domain, and checking the endpoint for additional malicious activity. The absence of observed credential misuse does not establish that credential capture did not occur.

Remedial training is valuable, but it is principally a corrective or post-incident measure and does not neutralize the immediate technical risk. Recovery would follow containment and eradication when affected services or systems require restoration.

NIST's current incident-response guidance emphasizes effective detection, response, and recovery actions to reduce incident impact rather than stopping after validation.

Study Guide Reference: Incident Response and Management → Incident Response Process → Analysis → Containment → Eradication → Recovery → Post-Incident Activities.