Technical tools support automated detection and response to incidents
Endpoint and account detection tooling with containment features gives the assessment step the signal it needs to decide whether an event is a real incident.
Detection tooling that supports rapid containment on endpoints and accounts gives responders the technical means to act during an incident, not only a plan.
Tooling that detects suspicious activity on endpoints and accounts and supports rapid containment is the detect-and-act pairing A.8.16 describes.