Glossary: Incident Response and Resilience

alert

Also written: alerts

An event that a tool has flagged as worth a look, such as the SIEM flagging a login to Sam's account from another country at 3 a.m. An alert only becomes an incident once analysis confirms it.