The primary difference between precursors and indicators is that precursors can
foresight future incidents whereas indicators detect previous or real time incidents that
can manifest. One primary example of precursors is contents of the web server log
showing usage of vulnerability scanner (rapid7, 2017). When it comes to indicator
results unfortunately some indicator results can create a false positive. This also can be
