Create incident response folders for on-call security before triage

Your security incidents arrive without organized case folders, causing delayed evidence collection and slower triage. Response teams get consistent folders created and linked so investigations start before first-hour SLAs lapse.