Begin with symptoms a responder can recognise and a safe first check. Link dashboards and logs, identify the owner and make escalation instructions explicit.
Keep destructive commands clearly separated from observation. After an incident, check the runbook against what actually happened and fix the missing steps.