Incident

An incident typically involves multiple related alerts that together describe a broader attack. Incidents require coordinated investigation and response, often involving multiple analysts and escalation paths. The transition from individual alerts to a unified incident narrative is one of the most important and difficult steps in security operations, as it requires correlating signals across tools, timeframes, and attack stages.