Intuitively we have the understanding that a security event is something bad. However, what does that actually mean? This presentation looks at events from an analyst’s perspective, covering events as actions having and locations. This presentation introduces concepts that will be expanded in the Network Noise and Anomalies and Indicators workshops.