Add "initiate incident response" as a decision outcome?

[ahouseholder]

Based on a comment from @j---, it's possible that a response decision could also involve an "inititate incident response". For example, if you're already behind on fixing something that's open exposure, actively exploited, and automatable, you might want to default to assuming you're already hit and so in addition to patching fast, you want to also investigate whether you're already hit.

[sei-vsarvepalli]

Justin from CISA Red Team pointed this out at the meeting on March 13, 2024.