Triage. Based on initial data such as logs, understanding the affected systems, time the breach was first spotted, the IR experts understand where they need to focus their effort.
Deployment where the IR experts deploy their IR tools.
Policy creation where the analysts customize their tools based on attack tidbits (aka Indicators of Attack) to scope and contain the attack across the full environment.
Recommendations and mitigations to close organizational security gaps as revealed by the IR analysis.
Reporting on the attack to various stakeholders.