Operations after attack to WDS


Hi all

I read some articles about “Monitoring water distribution systems” .
In all articles, has not been spoken about the operations after attack on the network.
I have two question,
1_ Where can I get information about actions after sensor alarms (or after-attack operation)?

2-can we simulate cleanup operation with epanet software or by EMT ? If we can,Which command should I use?