## Collect Initial Leads

1. Interview incident reporter(s).
1. Collect initial supporting data (_e.g._, alarms, events, data, assumptions, intuitions) in the incident file.
1. Interview SME(s) with domain or system expertise, to understand technical detail, context, and risk.
1. Interview SME(s) in affected business unit, to understand mission/business impact, context, and risk.
1. Ensure leads are relevant, detailed, and actionable.

### Reference: Response Resource List

Resource                  | Location
------------------------- | ------------------------------------
Critical information list | 
Critical asset list       | 
Asset management database | 
Network map               | 
SIEM console              | 
Log aggregator            | 

`TODO: Complete critical information and asset lists ("crown jewels"). This is incredibly important to effective response.`

`TODO: Customize response resource list`
