Security events

Every incident is an event, and almost no event is an incident.

Systems produce millions of events. A handful matter. The judgement that separates the two is where most of the work in a security operation actually sits, and it is judgement rather than a rule, because the same event is routine in one context and alarming in another. Confusing the two words leads to counting events and calling it security.