Immune responses triggered by pathogen-associated molecular patterns (PAMPs) are key to pathogen defense, but drivers and stabilizers of the growth-to-defense genetic reprogramming remain incompletely understood in plants. Here, we report a time-course study of the establishment of PAMP-triggered immunity (PTI) using cap analysis of gene expression. We show that around 15% of all transcription start sites (TSSs) rapidly induced during PTI define alternative transcription initiation events. From these, we identify clear examples of regulatory TSS change via alternative inclusion of target peptides or domains in encoded proteins, or of upstream open reading frames in mRNA leader sequences. We also find that 60% of PAMP response genes respond earlier than previously thought. In particular, a cluster of rapidly and transiently PAMP-induced genes is enriched in transcription factors (TFs) whose functions, previously associated with biological processes as diverse as abiotic stress adaptation and stem cell activity, appear to converge on growth restriction. Furthermore, examples of known potentiators of PTI, in one case under direct mitogen-activated protein kinase control, support the notion that the rapidly induced TFs could constitute direct links to PTI signaling pathways and drive gene expression changes underlying establishment of the immune state.