You can't fight what you haven't found. Start by identifying the fact that an attack is ongoing or imminent, then isolate it to limit the damage it can do. Implement your emergency containment plan and try to stop the attack. Finally, schedule a debrief for the security team to work out what happened, what went wrong, and what went right.