How to prepare for detection & response in the cloud