Preparation, detection, and analysis: the diagnostic work of IT security incident response