Understanding What You Did
✅ Mike Torres Phishing Incident - Contained!
The PICERL Framework
In Module 4, you investigated the phishing alert and executed the response playbook — covering Identification, Containment, Eradication, and Recovery. Now let's learn all 6 PICERL phases so you understand what each step meant and why it matters. Click each phase for an overview:
Scroll down to continue after exploring all phases ↓
Click each phase to learn more (0/6 explored)
Preparation: Planning Before the Attack
What Was Prepared Before Mike's Incident?
Click each item to learn how it helped during the incident:
Scroll down to continue after exploring ↓
Click each item to learn more (0/3 explored)
Identification & Containment: Reviewing Module 4
Identification: Finding the Attack
In Module 4, you completed these investigation steps as part of the Identification phase. Click each one to review what you did:
Scroll down to continue after exploring all items ↓
Click each investigation step to review (0/3 reviewed)
Containment Actions - Why They Work
Click each action to learn what you did and WHY it works:
Click each containment action to learn why it matters (0/5 explored)
Eradication: Removing All Traces
Eradication Steps From the Playbook
The same phishing playbook that guided containment also includes eradication steps. Click each one to see what we found:
Scroll down to continue after exploring ↓
Click each step to see the results (0/4 explored)
Recovery: Returning to Normal
Recovery Steps for Mike's Incident
Click each step to learn how we restored normal operations:
Scroll down to continue after exploring ↓
Click each step to learn more (0/3 explored)
Lessons Learned: Improving for Next Time
Post-Incident Review Questions
Click each question to see what the SOC team discussed after Mike's incident:
Scroll down to continue after exploring ↓
Click each question to learn more (0/4 explored)
PICERL Knowledge Check
Match each action from the Mike Torres incident to the correct PICERL phase!
Scroll down to match all items ↓
Match all items (0/6 matched)
Knowledge Check
💡 But Wait...
Remember those 200 alerts in the queue?
Each one takes 90+ minutes to investigate manually.
200 alerts × 90 minutes = 300 hours of work
But there are only 8 hours in a workday.
"It's literally impossible to investigate them all manually. There has to be a better way..."
In the final module, Maria will show you how XSIAM changes EVERYTHING.