How do we contain an incident without destroying the evidence?
Cut the network, not the power, and copy before you clean. Isolating an affected machine at the switch port, at the firewall or through the endpoint tool stops the attacker from using it, while memory, running processes and open connections stay intact for investigation. Before you reimage machines, delete files or remove accounts, export the relevant logs, note suspicious accounts and files and, where specialists advise it, take a memory capture and a disk image. Block the attacker's destinations at the firewall, but record which ones and when. If you must choose between speed and evidence, for example because encryption is spreading, speed wins: stop the damage first. Network evidence is the easiest to lose, because many devices keep only a short history; NetSenX keeps its alerts with time, hosts and destinations for the history your plan includes.