Module Quiz

An analyst contained a host by isolating it via EDR and blocking the C2 IP. The IR team later discovers they cannot determine the initial access vector because the Sysmon Event Logs on the host were overwritten during the 3 weeks before reimaging. What phase of the NIST IR lifecycle was skipped, and what should have been done?