Detection and analysis are integral parts of an incident response strategy. Signs of an incident may
be categorized as an incident detection precursor or an incident detection indicator. Precursors
reveal signs that an incident may appear in the future, where an indicator shows clues that an
incident may have occurred in the past or is occurring now. An example of a precursor event may be
logs showing a high number of failed logins attempts which may indicate someone is trying to guess
a user id and password to infiltrate the network. An incident detection example is an antimalware
software alert that a computer has been infected or compromised.
