incident response shell