This type of analysis is deterministic because it assigns fixed values to the scenario and calculates the expected outcomes based on those values. Deterministic analysis does not account for uncertainty or randomness in the scenario. References: https://learningnetworkstore.cisco.com/on-demand-e-learning
/understanding-cisco-cybersecurity-operations-fundamentals-cbrops-v1-0/CSCU-LP-CBROPS-V1-028093.
html (Module 3, Lesson 3.1.2)

In the context of the cyber kill chain model, spam campaigns fall under the "delivery" phase where attackers deliver malicious payloads via email or other means to target systems or networks. References: Cisco Cybersecurity Operations Fundamentals, Module 1: Security Concepts, Lesson 1.4: Security Monitoring,

According to the NIST Computer Security Incident Handling Guide, the next step in handling an event after confirming a potential indicator of compromise on an endpoint is to collect public information on the malware behavior. This step involves searching for information from various sources, such as antivirus vendors, security blogs, threat intelligence feeds, and online forums, to learn more about the characteristics, capabilities, and impact of the malware. This information can help the SOC team to identify the type, severity, andscope of the incident, as well as to determine the appropriate response actions and mitigation strategies.
Isolating the infected endpoint, performing forensics analysis, and prioritizing incident handling are subsequent steps that follow after collecting public information on the malware behavior. References:
Computer Security Incident Handling Guide
SP 800-61 Rev. 2, Computer Security Incident Handling Guide