Identifying the cause of an incident and recognizing the key elements to ask external entities when learning the background and potential infection vector of an incident, - Receiving and analyzing network alerts from various sources within the enterprise and determine possible causes of such alerts. - Knowledge of system and application security threats and attack methods (e.g., buffer overflow, mobile code, cross-site scripting, PL/SQL and injections, race conditions, covert channel, replay, return- oriented attacks, and malicious code).