The moment you realize your systems have been compromised, panic is the natural response. The urge to immediately pull the plug on everything and start wiping servers is strong, but acting entirely on adrenaline is a fast track to destroying critical forensic evidence.
In the first few hours, your priority should be containment. Isolate the affected systems from the rest of your network to prevent lateral movement, but keep them running if possible. You need those memory states and active logs to figure out exactly how the attackers got in and what they touched.
Once the bleeding is stopped, assemble your incident response team. This shouldn't be the first time they're talking to each other. You need a clear chain of command: who is investigating, who is communicating with stakeholders, and who is talking to legal counsel. Everyone needs to stay in their lane to avoid confusion.
Transparency is key during the first 24 hours. While you shouldn't speculate on things you don't know yet, you must be honest with your team and your affected users about the facts. Managing a breach is difficult, but managing a cover-up that gets exposed is practically impossible.