Definition
Detection is the process of identifying events, anomalies or activities that may indicate a Security Incident or another undesirable event.
Human Explanation
It answers: is something happening that requires attention?
Why it Matters
Early Detection reduces response time and potential incident impact.
Conceptual Boundary
Detection does not confirm an incident. The identified signal requires further analysis.
Practical Perspective
Detection may use logs, alerts, SIEM, EDR, IDS and behavioural analysis.