Containment

Execute short-term and long-term containment measures to prevent further spread of the threat across the environment. Isolate compromised hosts, disable affected accounts, apply network segmentation rules, and block known malicious indicators at perimeter and endpoint controls while preserving forensic evidence integrity.