Investigate incident ↓ Read incident state ↓ Inspect logs ↓ Run analysis ↓ Attempt remediation ↓ Report success __ __