How would you explain the difference between detection, containment, and remediation in incident response?