A set of logic statements to be applied to a data stream that produces an alert when an anomalous incident or behavior occurs.
Sources:
CNSSI 4009-2022
from
CNSSD No. 504
Event that causes the system to initiate a response. Note: Also known as "triggering event".
Sources:
CNSSI 4009-2022
from
ISO/IEC 27031