Incident response, on the other hand, shouldn't involve a lot of contemplation. A ticket comes in, someone decides how urgent it is, and who should handle it. For on call-situations, the person who first responds is typically tasked with only triage and mitigation. Root cause analysis comes later, maybe by somebody else. The critical questions to answer are "What is this?", "How is it affecting the system?", and "What is the best thing to do about it right now?" For some context, let me tell a story about an enterprise software deployment.