CS0-004: CompTIA Cybersecurity Analyst (CySA+)

During the analysis phase of incident response, security personnel perform triage — reviewing and validating detected events, determining their scope and severity, and prioritizing which incidents require further investigation or escalation. This is distinct from containment activities like isolation, eradication/recovery activities like reimaging, or preparation/detection activities like writing alert rules.