intuition in incident response