Cybersecurity Incident Response

# IR Overview

## PIC Phase
1. **Preparation**: Establishing IR policies, communication channels, and toolsets (SIEM, EDR, packet captures).
2. **Identification**: Detecting anomalies via IOCs. Distinguishing between false positives and true security incidents. Logging all evidence chain-of-custody.