Assertion: incident | /r/HasProperty | contained
Facets:
value: the sooner
type: MANNER
Source sentences:
text: The main purpose of containment is to contain the damage and prevent further damage from occurring (as noted in step number two, the earlier incidents are detected, the sooner they can be contained to minimize damage).
text: Once an incident is contained, the IR team can take the time necessary to tailor its next steps.
text: The purpose of this phase is to complete documentation that could not be prepared during the response process and investigate the incident further to identify its full scope, how it was contained and eradicated, what was done to recover the attacked systems, areas where the response team was effective, and areas that require improvement.