To prevent an incident from overwhelming resources, _ is necessary.
disconnection from the network
early containment
continuation of monitoring for other incidents
eradication of the issues