In cybersecurity incident response terminology, any observable occurrence within a system or network is defined as an _____, whereas an occurrence that violates policy or threatens security is classified as an incident.

### Why this is right The material specifically uses a suspicious quarantined email as an example of an event. An analyst assesses it and decides whether to release or eradicate it. ### The concept The example shows why classification matters: not every security-related observation immediately requires a full incident response. Analysts assess some events within established procedures. A system outage is described as an adverse event, while unauthorized data removal by an insider triggers full incident response. ### Terms - **Eradicate**: Remove the harmful item or cause from the environment. ### Remember A quarantined suspicious email is the material’s example of an event.