Networks & Defense
Containment
Also: isolation, incident containment
Actions that stop an incident from growing while keeping the evidence needed to understand it.
In more detail
Typical steps run from least to most disruptive: block a destination, disable an account or token, isolate a machine from the network while leaving it powered on, or take a service offline. Containment should be proportionate to the blast radius, and it comes before credential rotation so the attacker cannot collect the new secrets.