Security analysts frequently disagree about whether an alert should be treated as an incident, so similar alerts are handled in different ways. What is the BEST way for the information security manager to resolve this?
Select an answer to reveal the explanation.
Short Explanation
If two umpires call the same pitch differently, you don't need better eyesight; you need a clearer rulebook. Write down what turns an event into an incident and what happens next in each case. Treating every alert as an incident sounds safe, but it buries real problems under noise.
Full Explanation
An event is any observable occurrence; an incident is an event, or series of events, that harms or threatens the organization's information assets or operations and requires a response. The incident response plan should define the criteria that move an event to incident status, such as confirmed unauthorized access, impact on critical services or exposure of sensitive data, and the handling for each outcome. Clear definitions produce consistent decisions, make metrics reliable and ensure the right escalation is triggered. Treating every alert as an incident overwhelms responders, dilutes attention from real incidents and distorts reporting. Leaving each decision to the shift lead institutionalizes the inconsistency the manager is trying to remove, since different leads will apply different judgement. Tuning tools to produce fewer alerts may be worthwhile for noise reduction, but it does not resolve how analysts classify the alerts that remain, and aggressive tuning can suppress genuine signals. Exam caveat: the criteria should be reviewed as the threat landscape and business change, and analysts should be trained on them. Operational check: sample recent alerts, apply the documented criteria, and confirm that two analysts working independently reach the same classification.