Incident Detection Precursors signals that a security event or threat may happen in the future,
and the Incident Detection Indicators signals that a security event or threat is happening right
now. Neither response, precursor nor indicator, is guaranteed to be accurate. The problem is
the large number of events each working day, some of which might be legitimate precursors
or indicators. Intrusion detection systems, firewalls, and access control systems generate
many more signals but by themselves, these systems cannot usually determine whether the
