how to handle incident response siem