When you are the SOC: The first 60 minutes of incident response

Solo IT responders without a SOC need a simple confirm, contain, preserve, communicate loop to manage the first hour of an incident without destroying evidence.