Containment first, but preserve evidence: `dd if=/dev/sdX of=image.dd bs=4M conv=noerror,sync` before remediation. Snapshot memory too. Post-mortem without timelines = guesswork. Build IR runbooks and practice them in labs like bug404found: https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=en #cybersec #infosec #security #DFIR #IncidentResponse