What phase of the incident response process often involves adding firewall rules and patch- ing systems to address the incident?

The recovery phase often involves adding firewall rules and patching systems in addition to rebuilding systems. Although preparation may involve configuring firewall rules or reg- ular patching, it does not do so in response to an incident. Detection attempts to identify events and issues, and analysis involves investigating the events.