Create breach incident records for IT on-call before SLAs lapse

Your incoming breach reports arrive as raw webhooks, causing delayed triage and compliance gaps. Operations staff get clean incident records and a chat alert so triage happens before outreach SLAs lapse.