I turn existing architecture, public or internal documentation, sanitized incident evidence, and team knowledge into a clear guide that helps responders identify the failure stage, collect the right evidence, choose the next diagnostic step, and recognize when escalation is justified.