What ships out of the box
- Isolate host (CrowdStrike, SentinelOne, Defender)
- Revoke session (Azure AD, Okta, Google Workspace)
- Disable account + reset credentials
- Open ServiceNow / Jira / Zendesk ticket with full forensics packet
- Notify Slack / Teams / Email with redacted incident summary
- Generate ODPC 72-hour disclosure draft