How do you prioritize incidents when managing a high volume of alerts in a 24x7 SOC environment?