What is the difference between an event, an alert and an incident?

They are rungs on a ladder. An event is anything that happens and can be recorded: a login, a connection, a file change. An alert is an event, or a pattern of events, that a tool flags because it may matter, such as a workstation contacting a new outside server every few minutes. An incident is what you declare after looking at one or more alerts and concluding that security has actually been, or is being, compromised: an attacker is inside, data was stolen, a service was disrupted. The difference matters because obligations attach to incidents, not alerts: the NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. reporting deadlines start when you become aware of a significant incident, not when a tool raises an alert. NetSenX produces alerts with a plain-language reason; whether they form an incident remains your judgement, and that decision is recorded in the audit log.

← All 60 questions on Incident responseAll topics