PICERL: the six phases of incident response
PICERL is a six phase incident response process: Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned. It describes the order in which an incident is worked, from the setup you do beforehand to the report you write afterwards. Each letter is a phase with its own decisions and its own way of going wrong.
The six phases
P. Preparation
Everything you do before an incident so the other five phases are possible.
Log sources connected and parsing. Owners named for each system. Runbooks written and tested. Access to the tools you will need at 3am, granted before 3am. Most failures traced back to a bad incident start here, not in the response itself.
I. Identification
Deciding that something is an incident, and how bad it is.
Detection fires, someone triages it, and a call gets made. The measures that matter are time to detect and time to acknowledge, and how often the call was wrong in either direction. A missed incident and a week of chasing a false positive both start here.
C. Containment
Stopping the spread without destroying the evidence you need later.
Short term containment buys time: isolate the host, disable the account, block the address. Long term containment keeps the business running while you prepare to remove the cause. Move too fast and you lose the forensics. Move too slow and you lose more hosts.
E. Eradication
Removing the cause, not only the symptom.
The malware is deleted, the account is rotated, the vulnerability is patched, the persistence is gone. If you cannot say how the attacker got in, you are not finished. Eradication that skips root cause produces the same incident again a month later.
R. Recovery
Putting systems back into service and watching them closely.
Restore, validate, and monitor. The point of the monitoring is that recovery is when you find out whether eradication actually worked. Decide in advance what would send you back a phase, and who is allowed to make that call.
L. Lessons Learned
Writing down what happened while people still remember it.
A short report and a meeting inside two weeks. What worked, what did not, what will change, and who owns the change. This is the phase that gets skipped, and skipping it is why the same gap shows up in the next incident.
Where PICERL comes from
PICERL is the six step incident response process taught by the SANS Institute in its incident handling course and handbook. The letters stand for Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned. It predates most of the tooling built around it and is still the plainest description of how an incident is worked.
NIST 800-61 describes the same work in four phases and folds containment, eradication and recovery together. Neither is more correct. PICERL separates them because in practice they are separate decisions, made by different people, at different points.
How to apply PICERL
Use it as a checklist for coverage, not a script for an incident. Real incidents loop: you contain, learn something, and identify again. The value is in asking which phase your team is weakest at, and whether your tools help there or somewhere you were already fine.
Most SOCs measure Identification because it is easy to measure, and leave Preparation and Lessons Learned unmeasured because they are not incidents. That is usually where the time is actually lost.
The PICERL Index maps metrics to each phase and scores where an AI SOC actually helps.