Every alert detected by a Security Operations Center (SOC) is automatically a confirmed cybersecurity incident.

### Why this is right The statement is false because alerts can be false positives, routine activity, or suspicious signals that still need validation. The SOC triages alerts before escalating serious cases. ### The concept Monitoring tools generate alerts when activity matches a rule or looks unusual. An alert is a prompt to investigate, not proof that an attack succeeded. Analysts compare the signal with logs, asset context, user behavior, and threat intelligence. Escalation is appropriate when evidence and potential impact justify incident handling. Treating every alert as a confirmed incident overwhelms response teams; ignoring alerts without analysis can miss real attacks. ### The other options - **The statement is false**: An alert is an indicator for assessment, not automatic confirmation. ### Terms - **False positive**: An alert that indicates a threat when the activity is benign. - **Threat intelligence**: Information about threat actors, methods, indicators, or infrastructure used to inform defense. ### Remember An alert begins triage; evidence and context determine whether it becomes an incident.