Incident Response Branching

Objective

Use branches to separate investigation notes from stable documentation.

Scenario

A mock phishing alert needs triage. Create an incident branch and document a timeline, indicators, actions, and open questions.

Deliverables

• Branch named incident/phishing-triage.
• incidents/phishing-triage.md.
• Pull request summary explaining what changed and what still needs review.

Success Criteria

• The branch keeps draft investigation notes separate.
• The final merged file is sanitized and organized.