@brian_mcgough @DebugPrivilege At my company we’ll usually have a designated lead per shift on each active incident that will manage documentation/direction and field all meetings/comms. With that being said, performing IR without a desiccated lead or some form of management is atypical for a mature operation.