As strategic planners and analysts, we were engaged to design a DFIR lab to complement the Security Operations Center (SOC) of a global enterprise Managed Detect and Response services provider. By mapping out and analyzing the processes and activities that accompany an ongoing cyber incident that would target an enterprise, as well as the artifacts and response that characterize the aftermath, we were able to identify the procedures and tools required for effective real-world incident handling and payload analysis, regardless of the type of attack.