Use when responding to an incident in a cloud environment where there's no server to unplug — the API-driven, identity-centric response that differs from on-prem IR.
