Incident resolution is where the response becomes tangible. Reporting identified the problem. Registration created the record. Triage established the priority. Resolution is where the SOC actually does something about it: stops the damage, removes the threat, restores what was affected, and documents what happened. It is typically the most resource-intensive phase of the incident lifecycle, and its quality determines the difference between an incident that is properly closed and one that recurs because the root cause was never fully addressed.
Notification and Coordination #
Before technical work begins, the right people need to know the incident is active. This is not a step to defer until after containment. Coordination failures during incident response are one of the most consistent sources of avoidable delay and avoidable damage.
Internal notification covers the IT operations team who may need to take systems offline or change configurations, the security leadership who needs situational awareness for escalation decisions, legal and compliance whose involvement may be triggered by the incident type, and executive management if the severity warrants it. External notification may involve other CERTs, internet service providers, vendors whose products are implicated in the incident, law enforcement where criminal activity is suspected, and regulators where notification obligations apply.
Affected users also need communication appropriate to the situation. Telling users their accounts have been compromised and providing clear guidance on protective steps is both a security necessity and a trust management obligation. The communication should be factual, timely, and actionable.
Containment #
Containment stops the incident from spreading or causing further damage while the investigation and eradication work proceeds. It is the highest time-pressure activity in the resolution phase because every minute of uncontained adversarial access extends the potential damage.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
