All laws
Occam's Razor
Prefer the explanation that requires the fewest new assumptions.
If
Under incident pressure the mind reaches for the interesting hypothesis — a kernel bug, a bad disk, an attacker. The explanation requiring the fewest unverified assumptions is almost always the deploy that went out twenty minutes ago.
Then
Rank your hypotheses by how many unverified assumptions each needs, and test the cheapest first. Ask "what changed?" before "what is broken?"
Unless
Hickam's Dictum — a system can carry several independent faults at once, and the simplest story that fits the symptoms is not automatically the true one