Compare and contrast probable indicators to possible indicators and explain how they are different from one another.
Review the list of incident candidates as outlined in the text that are considered probable indicators of actual incidents:
Activities at unexpected times
Presence of new accounts
Reported attacks
Notification from an intrusion detection and prevention system (IDPS)
Summarize that probable indicators have a greater chance of an incident result but still require some investigation prior to that conclusion being made.