NIST SP 800-61 r2 outlines a structured incident handling lifecycle composed of four phases: Preparation, Detection and Analysis, Containment, Eradication, and Recovery, and Post-Incident Activity. Detection and Analysis involve identifying and investigating incidents, while Post-Incident Activity focuses on lessons learned and evidence retention for future reference.
SP 800-61 Rev. 2, Computer Security Incident Handling Guide | CSRC, Computer Security Incident Handling Guide - NIST, We Read NIST SP 800-61 so You Don't Have to.