“What is the whole response, not just the first hour?”
Full-lifecycle response plans: triggers, roles, containment decisions, eradication, recovery and the review afterwards. The first-hour playbooks tell you what to do now; these are what you adapt into your own runbook before anything happens.
A successful sign-in the user did not make, in Microsoft Entra ID and Microsoft 365. A password reset alone evicts almost nobody. The plan works through the order that does, how to tell a guessed password from a stolen session, and how to answer what they read.
An extortion demand with nothing encrypted, or your name on a leak site. Three questions run in parallel with three owners: is the claim real, what left and how, and what you are obliged to say and to whom. A plan for answering each one on evidence rather than on the attacker's framing.
Three shapes of the same incident: a malicious package, a compromised CI action, and a trojanised vendor update. They differ in what the attacker could reach, so they differ in what you rotate and where you hunt. A plan for scoping exposure from the version window, rotating the right secrets, and rebuilding from something you can trust.
A web shell, an exploited framework, or a server process doing things a web server never does. A plan for preserving the evidence that rotates fastest, finding the first malicious request, working out what the server could reach, and rebuilding so the same request fails next time.
Two responses that have to run at once. One is a race with a bank transfer measured in hours. The other is evicting an operator who is still reading the mailbox, and who survives a password reset unless you remove what they left behind.
The response where the usual instincts are wrong. Speed matters less than lawfulness, the suspect is a colleague with rights, and half of these turn out to be misunderstanding. A plan for investigating quietly, preserving what you would need, and being able to stand behind how you did it.
The whole response rather than the first hour of it: who decides what, how to contain without destroying the evidence you will need, what has to be true before you restore, and the notifications whose clocks started before you noticed.
