creating cloud detection and incident response knowledge base