# What is the difference between an event, an alert and an incident?

They are rungs on a ladder. An event is anything that happens and can be recorded: a login, a connection, a file change. An alert is an event, or a pattern of events, that a tool flags because it may matter, such as a workstation contacting a new outside server every few minutes. An incident is what you declare after looking at one or more alerts and concluding that security has actually been, or is being, compromised: an attacker is inside, data was stolen, a service was disrupted. The difference matters because obligations attach to incidents, not alerts: the NIS2 reporting deadlines start when you become aware of a significant incident, not when a tool raises an alert. NetSenX produces alerts with a plain-language reason; whether they form an incident remains your judgement, and that decision is recorded in the audit log.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/difference-between-an-event-an-alert-and-an-incident

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [How do we tell a real incident from a false alarm?](https://netsenx.com/en/faq/how-to-tell-a-real-incident-from-a-false-alarm)
- [How do we decide how serious an incident is?](https://netsenx.com/en/faq/how-to-decide-how-serious-an-incident-is)
- [Who makes the decisions during a cyber incident?](https://netsenx.com/en/faq/who-makes-decisions-during-a-cyber-incident)
- [What does management have to decide in the first day of a cyber incident?](https://netsenx.com/en/faq/what-management-decides-in-the-first-day-of-an-incident)
- [How do we communicate during an incident if our e-mail may be compromised?](https://netsenx.com/en/faq/how-to-communicate-when-email-may-be-compromised)