Overview
An incident cannot be handled until it is noticed. Detection is the phase where potential incidents are identified from the flood of everyday activity. Fast, accurate detection shrinks the damage an attacker can do.
Learning objectives
- Explain the goal of the detection phase.
- Identify sources that reveal incidents.
- Understand the challenge of separating signal from noise.
Core concept
Detection is recognizing that a security incident may be occurring or has occurred. Signals come from many sources:
- Automated alerts — from SIEM, intrusion detection systems, endpoint detection and response (EDR), and antivirus.
- Logs — authentication, network, application, and system logs showing anomalies.
- Human reports — an employee reporting a phishing email or odd behavior (often the fastest source).
- External notifications — a partner, customer, researcher, or law-enforcement tip-off.
How it works
Detection depends on the detective controls and logging established during preparation. The core difficulty is signal versus noise: real incidents hide among huge volumes of normal events and false positives. Tuning detections, correlating multiple weak signals, and centralizing logs in a SIEM all help analysts spot genuine incidents quickly. The key metric is again dwell time — reducing how long an attacker operates undetected.
Practical example
A SIEM correlates three low-level events on one account — a login from a new country, followed by access to unusual files, followed by a large outbound transfer. Individually each might be ignored; together the correlation raises a high-confidence alert that a security analyst picks up, marking the start of an incident. Without centralized logs and correlation, the three clues might never have been connected.
Cybersecurity relevance
Detection is the daily work of a Security Operations Center (SOC) and the heart of the SOC & Blue Team path. Its effectiveness is set by earlier choices — what is logged, what is monitored, and how well detections are tuned.
Common mistakes
- Too many false-positive alerts, causing alert fatigue so real ones are missed.
- Blind spots — systems that are not logged or monitored, where incidents go unseen.
- Ignoring human reports, which are often the earliest warning.
Key takeaways
- Detection identifies potential incidents from automated alerts, logs, human reports, and external tips.
- It relies on the logging and detective controls set up during preparation.
- The central challenge is separating true incidents from noise while minimizing dwell time.
Check your understanding
- List three sources that can reveal a security incident.
- Why can correlating several weak signals detect an incident that any single signal would miss?