Incident response procedures — detection, containment, eradication, recovery, lessons learned. NIST SP 800-61 / SANS PICERL aligned.
