I think the event vs incident discussion is really interesting. I've certainly met teams that have come to see cryptomining as just another event, rather than something that requires full incident response engagement. I'm not sure there's a standard ...