None
1) <insider threat> A set of logic statements to be applied to a data stream that produces an alert when an anomalous incident or behavior occurs
Source(s):
CNSSI 4009-2015
CNSSD No. 504
2) An event that causes the system to initiate a response.
Note: Also known as triggering event.
Source(s):
CNSSI 4009-2015
ISO/IEC 27031