Include the type of need, affected assets, urgency, tools already in place and any available evidence: alerts, logs, screenshots, reports or timeline.
Yes. Clearly state that it is an incident, avoid deleting traces and mention affected systems or accounts at risk.
Yes. The first exchange is used to understand context, confirm fit and identify reasonable next steps.