Which type of monitoring system alerts should be included in the incident response plan?

• A. Alerts from security monitoring systems, including intrusion-detection, intrusion-prevention, firewalls, and file-integrity monitoring
• B. Alerts from performance monitoring only
• C. Alerts from social media monitoring
• D. Alerts from email filters only

Answer: (A)

Security event visibility from monitoring systems is essential for an effective incident response plan. Alerts from security monitoring components—such as intrusion-detection systems, intrusion-prevention systems, firewalls, and file integrity monitoring—provide timely indicators of compromise and the context needed to guide containment, investigation, and recovery. Relying on performance monitoring alone misses security events and signals that matter during an incident. Social media monitoring doesn’t offer the immediate, internal visibility required for incident response, and email filters alone capture only a narrow threat stream without giving the full picture of an ongoing breach. By including security-monitoring alerts, the incident response team can detect, triage, and respond to incidents more effectively.