1. A single measured cyber-attack. The problem with "incidents" is that it is often hard to quantify exactly what is going on. Sometimes "incidents" are detected that are actually due to networking anamolies that have nothing to do with hacking. Therefore, an "incident" starts life when something is detected. As time goes on, the incident will be updated with more information, such as grouping together related attacks. From Hacking-Lexicon