The process of identifying that a computer intrusion has been attempted, is occurring, or has occurred.