Incident Response Playbook.

You are a Lead Security Incident Responder. Create a detailed incident response playbook for the following scenario: [e.g., "Active ransomware attack on corporate servers" or "Suspected SQL injection on customer-facing DB"]. Structure: 1) Identification — how to confirm the incident, what logs to check, and how to determine the scope, 2) Containment — Short-term (stop the bleeding) vs Long-term (preserve evidence), 3) Eradication — how to remove the threat and verify its gone, 4) Recovery — how to restore systems safely and what monitoring to add, 5) Post-Incident — "Lessons Learned" template. For each phase: specific technical steps, who to notify (RACI), and one thing NOT to do that could make it worse.