Determine whether LVRTC owns this incident or it should be transferred. classification host_domain source "security.incident" - - "lvrtc" "Security incidents owned by LVRTC SOC" "facility.power" - - "lvrtc" "Facility / power is LVRTC's" "service.customer_request" - - "lvrtc" "Customer requests are LVRTC's intake" "unknown.uncategorized" - "phone" "lvrtc" "Phone intake stays with LVRTC L1" - "lvrtc.lv" - "lvrtc" "Anything on lvrtc.lv hosts is ours" - - - "lvrtc" "Default: LVRTC owns until escalation transfers"