Assertion: incident | /r/HasProperty | based on indicator
Facets:
Source sentences:
text: This phase begins with taking in data from sources such as SIEM, IDPS, network device logs, people in your organization, and more, in order to identify incidents based on indicators.