Are Local LLMs Useful in Incident Response? - SANS Internet Storm Center - eviltoast