What defines an attack, an event, and an incident?
A. Symantec takes each attack description that comes out of each firewall and IDS system, and correlates those all to a central attack description or firewall diagnostic or security event description of our own creation. Then, for each of those, we make a judgment call on whether it is something that should be reported or not. The majority of reports we get are classified as events or probes, things you should not report on. They are not attacks in and of themselves. There are other attempts that, were the victim vulnerable to what was being checked for, they would just have been penetrated. These attempts we classify as incidents.
