Stress that definite indicators are incident candidates of something that is happening or has happened. Better put, they are clear signals.
Establish an understanding that the IR plan must be activated immediately in a situation like this, and the CSIRT must act.
Review the list of incident candidates that are red flags and are considered definite indicators of an actual incident:
Use of dormant accounts
Changes to logs
Presence of hacker tools (both physical and digital)
Notifications by a partner or peer
Notifications by a hacker