Incident detection precursors
It is a signal that an incident may occur in the future.
It is based on publicly available information, such as vendor advisories and security
blogs, and information received via threat intelligence sources or detection of
reconnaissance action from attackers (Impe, 1).
Example: An announcement of a new exploit that targets a vulnerability of the organization’s
mail server (Creasey, 2).
Incident detection indicators
It is a signal that an incident may have occurred or is underway.
It can come via alerts from security solutions, suspicious behaviour observed in logs,
or reports from people within or outside the organization (Impe, 1).
Example:Antivirus software alerts when it detects that a host is infected with malware
(Creasey, 2).
%
The industry where incident detection precursor and incident detection indicator take place is
