$1.$ You are facing two simultaneous incidents. The first is related to the availability of a web server your company uses to sell their products $($an e$-$commerce website$).$ The second is about a disgruntled employee sending out descriptions and prices of products in a research stage exfiltrated from an internal database. What stage of the incident response plan should help determine the priority of these incidents?