Should we hire an incident-response firm or handle an incident ourselves?
Handle the first hour yourselves, and bring in a firm for anything beyond a contained single device. Your own team knows the systems, so it should isolate machines, start the log and preserve evidence. An outside firm brings what a small team rarely has: forensic tools and experience, knowledge of attackers' habits, contacts with law enforcement, and credibility with insurers and regulators. Call one when an attacker may still be active, when servers or many devices are affected, when data may have left, or when the incident may be reportable or lead to a claim. Check first whether your cyber insurance names a firm, since using another can affect cover, and agree in advance what access they will need. NetSenX is not an incident-response firm; the explained alerts and network history it keeps are what that firm will ask for on day one.