In the event of a crisis, the OCINT-CSIRT correctly assesses the situation and, if necessary, quickly arrives on site at the customer. We bring the incident under control and develop strategies to minimize the extent of damage. By securing and examining the required evidence with the appropriate tools, we then clarify the course of the incident. In addition, the root cause is determined so that the point of entry can be remedied in order to be protected in the future.