[&] What is an event in the context of security monitoring?
- A notification triggered by a predefined rule.
- A confirmed security breach that requires action.
- An unread log entry in a monitoring system.
- Any observable occurrence in a system or network.

[&] Which of the following best describes an incident?
- An observable action logged during operation
- A potential security issue awaiting validation
- A hypothetical scenario developed for training
- A confirmed threat requiring investigation and response

[&] Why is it important to distinguish between events, alerts, and incidents?
- To increase system performance
- To reduce overall operating costs
- To prevent misunderstandings and improve triage efficiency
- To ensure the right team handles the data

[&] Why is understanding false positives important in incident analysis?
- It helps reduce unnecessary work for analysts
- It guarantees that all systems run efficiently
- It ensures that all alerts are escalated
- It minimizes the usage of storage for logs

[&] What key concept differentiates an alert from an event?
- Alerts are generated by human input.
- Events exclude any unusual activity.
- Events are confirmed security breaches.
- Alerts are generated when predefined conditions are met.

[&] How do incidents differ from alerts?
- Incidents are generated by detection rules.
- Alerts and incidents are identical terms.
- Incidents require a response and remediation.
- Alerts are always the result of manual input.