How does detecting lateral movement in networks actually work in practice during an incident response exercise for my capstone project.