When a SOC analyst recommends a "long-term containment" action on a confirmed incident, what is being proposed?