1) A set of logic statements to be applied to a data stream that produces an alert when an anomalous incident or behavior occurs
(CNSSD No. 504)
2) An event that causes the system to initiate a response.
Note: Also known as triggering event.