Describe the activities that make up the detection and analysis phase of the incident response life cycle, including identification of indication sources, analysis of an intrusion event, documentation, and notification of the incident.
Examples: unusual outbound network traffic or geographical irregularities, which indicate a possible breach or compromise
