It would be useful from visibility and reporting perspective to see when an incident/alert has been passed to IR (i.e. Major Incident)