Detection & Response
Incident Response
Also: IR
The process of detecting, containing, investigating and recovering from a security incident.
In more detail
Typical phases are preparation, detection, containment, eradication, recovery and review. For agent incidents, preparation means knowing which agents run where, having the logs to reconstruct their actions and being able to revoke their credentials fast.