quick

Question 1

Phishing

Answer 1

Analyze
Malicious?
Get IOC
Delete email
Forensics
Password change
Rebuild if necessary
Mandatory training
Lessons learned

Question 2

Malware

Answer 2

Isolate
Hash and analyze
Find POI
Close gaps
Add IOCs to endpoint protection
Preserve artifacts…
Restore impacted systems (backup, snapshot)
Remediate vulnerabilities
Reset passwords
Continue to monitor