Modern Incident Response

In basically every book or other ressource they talk about pulling a disk image/memory image and then analysing it, but is this the way to do it nowadays? I can only imagine that the company at risk cannot wait for all that to happen, so how does modern IR work?
I heard that often a EDR solution like S1 is deployed but is it possible to find the whole timeline of the incident with tools like this?

book cybersecurity disk edr image incident incident response memory response risk solution the company work