Initial cyber incident detection steps