Heres how the RN handle it..
Initial detection-gather intel from EW,radar,opintel,visual in possible
Report track on AAWC or LAAWc net to task group..''new unknown track 1234...Squawking....etc"
Track continues to close-warnings reader mans 121.5/243 and issues warnings giving position of a/c from known landmark/vrp brg/dist
Track continues to close-no id as yet,no response from warnings,appears to be flying an attack profile and not squawking-Update track to suspect,report on AAWC LAAWC net,transmit on link 11/16-air threat upgraded to yellow/red.
Track continues to close-warning readers give warnings,roe dependant then stand to ciws/trackers...
The next phase involves an initial whoosh and a splash some time later.
The USN procedures differ not one iota from the RNs,the ops room guidelines on anti-air warfare are all laid out in a nato publication which (surprisingly) can be viewed online-its called ATP-1c.There are various other ones also but I dont think it good to post those here.No doubt all on google anyway though!