Let's say you were investigating a security incident and didn't know how to remediate it, what steps would you follow to figure it out?