Precursors indicate that incident may occur in future. Indicators give
information that incident might have occurred or is happening now. An
example of each is that a precursor might be information from the
internet showing the usage of a vulnerability scanner and a Indicator
could be as simple as a alert from a antivirus software. Even though
Precursors are used to prevent incidents, Indicators are more common
and what the incident response teams sees first. Indicator sources can
produce thousands alerts a day sometimes they may be a false positive
alert. That is why it is important that prioritizing incidents are super
important for proper incident handling.
Precursor/ Incident Reference Link
