Create incident tasks for on-call responders before SLAs lapse

Your security incident reports land untriaged, causing delayed containment and unclear ownership. Responders receive assigned incident tasks with ticket links so containment happens before response SLAs lapse.