What steps would you take to investigate a potential security incident in your cloud environment?