Summarize the practice of incident classification and why it is important for an IR plan to have this included to determine the severity of threats that may occur.
Recall that incidents are the responsibility of the CSIRT except for an organization having a security operations center (SOC).
Review the first step in the IR process, which is to detect the incident (termed as incident detection in the text).
Relate that Donald Pipkin identified three categories of incident indicators: possible, probable, and definite.