Handle the incident. The defensible record writes itself.
“I do the whole investigation and then spend an hour writing it up so it holds if anyone challenges it.” — if that sounds familiar, this page is for you.
What it looks like
The decision screen — level, rationale, and the record posting itself.
Part of Resolve
This is one piece of Resolve — see the whole module for how it fits together.