Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
Stopping an attack from spreading while the investigation is still running: pulling a machine off the network, disabling an account, blocking a domain. It buys time. It is deliberately not cleanup, because the evidence still has to survive.