Adding firewall rules and patching systems to address an incident are usually related to what phase of the incident response process?

During the recovery phase, it is often necessary to configure firewall rules, patch systems, and rebuild them. While preparing for an incident, firewall rules may be configured or systems may be patched regularly, but not in response to an incident. Containment may require both actions, but it is less common since the focus is on implementing broader solutions, while eradication aims to eliminate the threat entirely.