The average time to detect an incident known as dwell time is still fairly long. FireEyes M-Trends 2018 report, the global median dwell time was 101 days in 2017, ranging from 75.5 days in the Americas to 175 days in Europe, the Middle East and Africa (EMEA) and a whopping 498 days in Asia-Pacific. There are essentially two different types of signs of an incident: precursors and indicators. Indicators can come via alerts from security solutions, suspicious behavior observed in logs or reports from people within or outside the organization.”]