Create investigation folders for incident tickets before standup

Your incident tickets arrive without a shared case folder, causing delayed evidence collection. Give teams a dated folder, copied investigation doc, and ticket note so triage finishes before standup.