move collect behavior log view state logic into controller
move incident creation/type handling into controller