During an investigation, an incident response team attempts to understand the source of an incident. Which of the following incident response activities describes this process?

Analysis involves thoroughly investigating the incident to understand its root cause, scope, and impact. This includes identifying the attack vector, compromised systems, and data exfiltration, which directly aligns with understanding the source of the incident. Lessons learned occurs after the incident is resolved, focusing on process improvement. Detection is the initial identification of an incident, not the in-depth understanding of its source. Containment aims to limit the damage and prevent further spread, which is a response action rather than a source identification activity.