Incident response content: real-world investigation notes, timelines, checklists, and “how we contained it” writeups.