Type "Intrusion Response Procedure" into google and you're likely to get nothing. Just lots of references to "you should create an IRP, blah, blah, blah..." Well, I found a reasonable paper. Here it is.

Intrusion Response Paper with Substance