This activity is Recovery because it focuses on restoring systems and business operations to a normal, trusted state after the threat has been contained and eradicated. Restoring encrypted data from backups, rebuilding compromised workstations, and re-enabling network access are all recovery tasks. The key objective in recovery is to return services safely while ensuring the environment is clean and stable—hence validation steps before reconnecting systems to production networks. Containment would have occurred earlier and would include isolating affected VLANs/hosts and stopping spread. Eradication would include removing ransomware artifacts, closing persistence, patching vulnerabilities (which the scenario says has already been done), and ensuring the attacker cannot regain access. Post-incident activities occur after recovery and include lessons learned, reporting, process improvements, and control updates. From a SOC operational standpoint, recovery is often the most resource-intensive phase because it requires coordination between security, IT operations, application owners, and business units to restore systems, verify integrity, and monitor for reinfection. Because the scenario is explicitly about restore/rebuild and safe return-to-service, the correct phase is recovery.

These actions align most strongly with eradication because they are removing the root cause of compromise and eliminating the adversary’s ability to persist. Applying an emergency patch to the exploited mail server closes the vulnerability that enabled initial access. Updating mail filtering rules to block the malicious payload reduces reinfection risk and removes the delivery path. Network segmentation can be a containment measure, but in this context it is being implemented as a corrective control to prevent continued lateral movement and re-compromise as part of eliminating the threat’s operational pathways. Evidence gathering is already implied by the forensic identification of the exploited CVE; recovery would involve restoring services and data after the threat is removed. In SOC practice, containment stops immediate spread (isolate servers, block traffic), while eradication focuses on removing malware, closing exploited vulnerabilities, removing persistence, and making the environment safe for return-to-service. Because the scenario explicitly includes patching and control changes aimed at eliminating the exploit vector and stopping recurrence, eradication is the best fit.

Web services attacks can be mitigated by filtering improper XML syntax because these attacks often exploit vulnerabilities in web services that accept XML input. XML filtering ensures that only properly formatted XML data is processed by the web service. This can prevent various forms of XML-related attacks, such as XML injection or XML External Entity (XXE) attacks, where attackers attempt to interfere with the processing of XML data.

A DHCP Starvation Attack is a type of network attack that aims to deplete the pool of available IP addresses on the DHCP server. The attacker floods the DHCP server with fake DHCP DISCOVER messages using spoofed MAC addresses. If successful, the server will exhaust its address space, denying IP configuration to legitimate clients. This can lead to a denial of service (DoS) for new devices attempting to join the network.  Additionally, the attacker may set up a rogue DHCP server to issue malicious IP configurations to clients, potentially redirecting traffic or causing further disruption 1 .

The eradication stage is where the root cause of the incident is determined from the forensic results. This stage involves not only removing the threat from the affected systems but also identifying and fixing the vulnerabilities that were exploited. It’s crucial to understand how the incident occurred to prevent future occurrences. After the containment stage, where the immediate threat is isolated, eradication ensures that the threat is completely removed and that the root cause is addressed.

SIEM use case management is the process of defining, implementing, tuning, and governing detection scenarios (use cases) so that alerts align with the organization’s real risks and operating environment. High false positives often result from generic rules not tuned to local baselines, missing context, or unclear detection objectives. Use case management addresses this by documenting what threat is being detected, what data sources are required, what “good” vs “bad” looks like, expected false positives, severity mapping, and response actions. It includes iterative tuning: refining thresholds, adding allowlists, improving parsing/normalization, and validating detections against real activity and test cases. “Security analytics” is a broad term that includes detections and analysis, but the question emphasizes a structured process of defining scenarios aligned to risk—use case management. IT compliance is focused on meeting regulatory requirements, not reducing alert noise through scenario design. Log forensics is deep investigation of events after the fact, not the proactive engineering process of improving detection quality. From a SOC viewpoint, mature use case management is a primary lever for reducing alert fatigue while increasing true-positive detection.

The scenario described involves an attacker modifying the URL parameters to alter the price of a product, which is a classic example of a Parameter Tampering attack. This type of attack occurs when an attacker manipulates parameters exchanged between client and server in order to modify application data, such as user credentials, permissions, and price of products, as seen in this case.

The original URL indicates that the product price ( debit ) is set to $100. The attacker has modified this parameter value to $10 in the modified URL, thus exploiting the logic validation mechanism of the e-commerce website to purchase the product at a lower price. This manipulation of parameters is indicative of a Parameter Tampering attack, which is a form of web-based attack where the properties of a web application are altered to achieve unintended outcomes by the attacker.