Incident response runbooks, written from the console.

Triaging a Google Workspace account takeover, step by step

Validate the alert, preserve evidence, contain the account, hunt for persistence, and scope what the attacker touched.