You think you have been breached and do not yet know what happened

The umbrella playbook, for the hour before you know which of the others you are in. Its whole job is to stop you making the next hour harder: preserve what expires, establish scope, and avoid the three moves that destroy evidence.

Trigger. A tip-off, an anomaly nobody can explain, a ransom email, or a bad feeling somebody senior has acted on.

The first 60 minutes1 of 5 expire

01 02 03 04 05

030 min60

01
Write down what you actually know, and when you knew it
by 10 min
One timeline document, started now, with times in UTC and a note of who said what. Everything after this depends on it, and reconstructing it later from memory and chat scrollback is how incidents lose their facts.
02
Preserve what expires, in order of how fast it goes
by 25 minexpires
Memory on anything still running, then the shortest-retention logs you have, then endpoint logs on anything suspected. Export rather than query: a working copy you hold is worth more than a search you can rerun until the day you cannot.

Tell somebody

Executive, early and with a scope estimate you have said out loud is provisional
Legal, before anyone writes anything they would not want read back to them
Insurers, who frequently require notification before you engage outside help if you want it covered

Drawn from

The documents these steps come from, so you can check one rather than take it on trust.

The evidence

What each source proves, and what it does not.

logon events

Collect it in one go

A read-only script that gathers most of the above in volatility order, with a hash manifest.

Triage collection

Make it yours

Replace the escalation list with real names, and the timings with what your change process actually allows. A playbook that assumes an authority you do not have will stall at the step that needed it.

Write down what you actually know, and when you knew it

Preserve what expires, in order of how fast it goes