Detect
identify potential incidents.
Services: Monitoring and Detection; Incident Report Acceptance.
Note: The phase of incident management where the IR team wants to confirm and gather additional detection tools and signatures is part of the Mitigation phase, not Detection. The Detection action focuses only on initial detection of the incident.