Antivirus software alerts that a host is infected with malware. In the incident handling guide's terms, this is an example of what?

1. Ask what the sign tells you about timing, because that is what separates the two categories. 2. An antivirus alert that a host *is infected* reports a state that already exists so it is a sign that an incident "may have occurred or may be occurring now". That is the definition of an indicator. 3. Section 3.2.2 lists this example almost word for word: "Antivirus software alerts when it detects that a host is infected with malware." 4. A precursor would have to point forward, like the guide's own examples: web server log entries showing a vulnerability scanner in use, an announcement of a new exploit against the organization's mail server, or a group threatening to attack. 5. A false positive is possible for any alert, but it is a judgement about accuracy rather than a category of sign. The guide notes indicators must still be evaluated, since some "could happen for several reasons other than a security incident, including human error". 6. A network flow is a source of signs, defined as "a particular communication session occurring between hosts", not a sign itself. _Source: NIST SP 800-61 Rev. 2 "Computer Security Incident Handling Guide" (Aug 2012), section 3.2.2 "Signs of an Incident"_