22. Run an incident response from alert to recovery
Follow an incident from first alert through triage, containment, eradication, recovery, communication, and lessons learned. This end-to-end workflow shows how real teams make decisions under pressure.