A typical day of attack or ‘an episode’: How DISA battles cyberthreats