Create incident records from security alerts before standup

Your external security alerts arrive unlogged, leaving triage blind and raising incident escalation risk. This captures each alert into a searchable incident table so on-call analysts see new items before morning standup.