Network security monitoring in incidents