Start here....

http://www.sans.org/rr/incident/

its a great set of documents.