Which phase of the incident response process consists of monitoring cybersecurity and IT tools for unusual or suspicious behavior and investigating potential IOCs and IOAs?
A. Preparation
B. Detection and analysis
C. Containment and eradication
D. Post incident activities
