Extensive logging of events is regularly done by security devices such as firewalls and routers. Significant time is spent reviewing these logs to determine if systems are under attack, and funds are spent in purchasing event correlation software to readily combine the output of separate sources in the hope of detecting attacks missed by the separate reviewing of individual logs. In addition, intrusion detection systems are put in place to alert of intrusions, and results from such systems are both individually reviewed and coordinated with other information. Detecting the occurrence of incidents is clearly of great importance to enterprises. Little attention, though, has been paid to the ways to properly respond to incidents of an actually or even potentially damaging nature. This writing discusses what is involved in proper incident response.