Detect and report events.

In order to respond to incidents you need to detect them. Detection can come in various forms. Users can notify the incident response team of an incident. The incident response team can also receive alerts from your systems.

Configure your systems to create alerts or alarms to notify you of important events that indicate a security incident. An example is receiving an alert from your anti-malware software that a malicious file was detected. Another example is an alert of a device on your network going down. After detecting an event you need to determine if it is a security incident which will allow you to activate your incident response plan. You need to report events and security incidents to the appropriate persons in your company so that they can react to them.