I had the queries from the incident-response going to this topic