IR Lifecycle Overlay (NIST SP 800-61r2)

Kill Chain Stage	IR Phase	Response Action
Recon / Weaponization	Preparation	Harden attack surface, tune detections, threat intel ingest
Delivery / Exploitation	Detection & Analysis	Alert triage, scope, confirm compromise
Installation / C2	Containment	Isolate host, block C2 domains/IPs, disable accounts
Actions on Objectives	Eradication	Remove malware/persistence, patch exploited vuln
Post-intrusion	Recovery	Rebuild, restore, monitor for recurrence
—	Post-Incident	Lessons learned, update playbooks/detections