## Timeline
- HH:MM — Incident detected (how?)
- HH:MM — Response initiated
- HH:MM — Containment achieved
- HH:MM — Root cause identified
- HH:MM — Remediation complete