Incident detection precursors signal a failure in the system being used to
detect such an incident. For example, finding that a system's antivirus,
firewall, or other security systems are turned off or disabled is a
precursor. This is different from an incident detection indicator. An
indicator points to a situation that is currently ongoing. For example,
finding that a computer is now communicating on a restricted port, to a
restricted address, or otherwise operating outside of its normal
