Merge pull request #71403 from openshift/wgordon17-customer-initiated-incident-documentation

Include ROSA customer-initiated incident documentation

Author: EricPonvelle

modules/rosa-policy-incident.adoc

@@ -109,6 +109,13 @@ When managing a new incident, Red Hat uses the following general workflow:
 . The incident is documented and a root cause analysis (RCA) is performed within 5 business days of the incident.
 . An RCA draft document will be shared with the customer within 7 business days of the incident.
 
+Red Hat also assists with customer incidents raised through support cases. 
+Red Hat can assist with activities including but not limited to:
+
+* Forensic gathering, including isolating virtual compute
+* Guiding compute image collection
+* Providing collected audit logs
+
 [id="rosa-policy-notifications_{context}"]
 == Notifications
 Platform notifications are configured using email. Some customer notifications are also sent to an account's corresponding Red Hat account team, including a Technical Account Manager, if applicable.
@@ -162,4 +169,4 @@ The following activities can trigger notifications:
 
 The impact of a cluster upgrade on capacity is evaluated as part of the upgrade testing process to ensure that capacity is not negatively impacted by new additions to the cluster. During a cluster upgrade, additional worker nodes are added to make sure that total cluster capacity is maintained during the upgrade process.
 
-Capacity evaluations by the Red Hat SRE staff also happen in response to alerts from the cluster, after usage thresholds are exceeded for a certain period of time. Such alerts can also result in a notification to the customer.
+Capacity evaluations by the Red Hat SRE staff also happen in response to alerts from the cluster, after usage thresholds are exceeded for a certain period of time. Such alerts can also result in a notification to the customer.