How do you prioritize alerts when investigating multiple security incidents simultaneously?