After investigating a recent security incident, a SOC analyst is charged with creating a reference guide for the entire team to use.

Which of the following should the analyst create to address future incidents?