I've heard this concept discussed before yet have failed to actually put one together. I started drafting this post back in October, when the concept came up again at a talk during (ISC)² Security Congress 2022 (day one, during "Incident Response Ready - Key Steps of a