Incident Response

[esecuritydude () gmail com]

Hi List,

I'm currently doing a uni assignment where I have to investigate an intrusion into a *nix file server and describe:

a) What I would do for the current incident

b) What I would recommend for the future.

Does anyone have any classic real life examples of  this? and where could I find a good/standard incident response 
procedure?

Thanks in Advance,
Miguel