Triaging and Remediating a Risky User Event