Event, Alert, Incident

What is it?

An Event is any observable occurrence (a logon, a DNS query). An Alert is a detection rule flagging events as worth attention. An Incident is a validated situation that harms — or credibly threatens — confidentiality, integrity or availability, and it triggers a response process.

Why it matters

Millions of events, hundreds of alerts, few incidents. Escalating every alert as an incident burns the response process; missing the promotion of a real one burns the company.

Where you see it

The moment a SOC analyst or engineer decides an alert crosses the line and declares an incident.

What normal looks like

Alerts triaged and mostly closed; the small fraction that carries validated harm formally declared as incidents with an owner and a severity.

What suspicious looks like

An alert with confirmed malicious execution or data access still sitting in a queue as 'just an alert' hours later.

How analysts investigate

By asking what has been VALIDATED, not what has been suspected: an incident declaration is a claim about evidence, and the declaration threshold is defined before the pressure starts.

Common beginner mistakes

Using 'incident' loosely for anything unusual — the word triggers process, people and paperwork; spending it on noise teaches the organization to ignore it.

At Marasi Logistics — the shipping company this whole path follows — the night watch sees 2.1 million events, 118 alerts, and, on a bad night, one incident. This lesson is about drawing those three lines correctly.

Level	What it is	Who acts
Event	Any recorded occurrence — almost all benign	Nobody, usually
Alert	Detection logic says: look at this	SOC analyst triages
Incident	Validated harm or credible threat to CIA	Response process with an owner

Quick check

An analyst confirms a macro document executed PowerShell on a Marasi workstation and the process contacted an unknown external host. What is this now?

A quick self-check — it doesn't affect your XP or progress.