The first hour is about confirming what is happening and stopping it from spreading. Gather the facts, isolate affected systems and avoid actions that destroy evidence.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- Confirm the alert with a second source
- Isolate affected hosts from the network
- Start a timeline of every action
Making it stick
Do not switch off systems unless needed. Memory may hold vital evidence. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.