What must be included when describing alerts in the incident response plan?

• A. The plan should exclude routine alerts to avoid overload
• B. The incident response plan must include alerts from security monitoring systems (IDS/IPS, firewalls, and file integrity)
• C. Alerts are optional if monitoring is not used
• D. Alerts are only for critical systems

Answer: (B)

In an incident response plan, you must describe how alerts will be generated and acted upon to detect and respond quickly. Alerts from security monitoring systems—such as intrusion detection or prevention systems, firewalls, and file integrity monitoring—provide visibility across both network and host layers. The plan should specify which alerts matter, how they are prioritized, who gets notified, and what steps to take for escalation and containment. This ensures the team can respond consistently to real threats rather than reacting haphazardly.

Excluding routine alerts would drown important signals in noise and miss genuine incidents. Making alerts optional if monitoring isn’t used leaves the organization blind to attacks that could otherwise be detected early. Limiting alerts only to critical systems ignores other assets that can be compromised or become footholds for attackers. By including alerts from these monitoring sources, the plan supports timely detection, proper triage, and coordinated response across the environment.