The second phase of the incident response process includes two steps: detection and analysis. There are multiple ways that we can detect an incident or event, such as through log analysis, network traffic monitoring, or other security tools. Continuous monitoring on the different attack vectors with various tools provides information for the incident response team members to analyze data for the appropriate actions on incidents and events.