Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

Incident Response and Forensics Terms

When something goes wrong, such as a ransom note, a hacked website, or a mailbox sending invoices nobody wrote, the first hour sets up everything that follows. These terms follow the order of a real response: spotting the signs, containing the damage, removing the attacker, recovering, and learning from it. Each one is explained in plain English and cites NIST, CISA, or another primary source.

Start here

  • Incident response: The organized process of detecting a security incident, limiting the damage, removing the attacker, restoring normal operations, and learning from what happened.
  • NIST SP 800-61 incident lifecycle: NIST's incident response guidance. Revision 3 (April 2025) aligns incident response with the six NIST CSF 2.0 Functions and supersedes the 2012 four-phase lifecycle.
  • Indicators of compromise (IOC): Technical artifacts or observables, such as file hashes, IP addresses, domains, and file extensions, that suggest an attack is coming, underway, or has already happened.
  • Triage: The first incident response decision: confirming whether an alert or report is a real incident, estimating its severity and urgency, and deciding who responds.
  • Containment: The incident response stage that stops an attack from spreading or causing more damage, such as isolating systems or disabling accounts, while preserving evidence.
  • Eradication: The incident response stage that removes malware, backdoors, rogue accounts, and the exploited weakness so the attacker cannot regain access.
  • Recovery: The incident response stage that restores systems and data to normal operation after the attacker is removed, then verifies and monitors that they stay clean.
  • Post-incident review (lessons learned): A structured review after a security incident that documents what happened, evaluates the response, identifies root causes, and assigns improvements.
  • Chain of custody: The documented record of who collected, handled, transferred, and stored each piece of evidence, when, and why, so it can be trusted later.
  • Forensic image (snapshot): An exact, bit-for-bit copy of a disk, memory, or virtual machine, made without changing the original and verified with a hash, so evidence survives cleanup.

Last updated October 14, 2026.