The phase that typically occurs before containment in an incident response is Identification. This phase involves detecting and determining the nature of the incident. It’s crucial to correctly identify an incident before it can be contained, as containment strategies may vary depending on the type of incident.

References: The Incident Response process is generally organized into several key phases, which include Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned1. Identification is the phase where the incident is first recognized and understood, which logically precedes the Containment phase, where measures are taken to limit the impact of the incident.