(a) Notify [Assignment: incident response personnel] of detected suspicious events; and
(b) Take the following actions upon detection: [Assignment: least-disruptive actions].
Supplemental Guidance
Least-disruptive actions include initiating requests for human responses.