Network traffic analysis for incident response