| 5.1.2.2. Did it find and Eliminate Threat? |
| 5.1.2.2.1. If Yes, consider acquiring binary for online analysis at |
 | 5.1.2.2.1.1. Apply online analysis info to create a response policy. |
| 5.1.2.2.2. If No Then consider 1.1.6 for memory analysis of |
| 5.1.2.2. Did it find and Eliminate Threat? |
| 5.1.2.2.1. If Yes, consider acquiring binary for online analysis at |
| 5.1.2.2.1.1. Apply online analysis info to create a response policy. |
| 5.1.2.2.2. If No Then consider 1.1.6 for memory analysis of |