Incident declaration and escalation paths

Not every alert is an incident. Declaring an incident is a formal decision that activates the incident response plan: it assigns an incident manager, mobilizes resources, starts formal documentation and triggers communication duties. Declaring too late wastes precious time while the attacker works; declaring for everything wears people out and dilutes attention. Clear criteria and escalation paths help analysts make the call quickly and confidently.