This presentation examines Red Hat Information Security team’s alligator fighting over the last 7 years, how we came to our liberating realisation, and how we refocused our activities. The question we continue to ask ourselves is: “How do we get back to our objective?” That is, how do we make things hard for our adversaries and minimise the impact of information security incidents. This talk looks specifically at our work on the Network Intrusion and Anomaly Detection, in the context of the incident management in a dynamic business environment (and the cloud!). The Red Hat Information Security Team was formed in 2009 and we take a look at our development during this time, looking at our major milestones and why they are important. This journey is far from complete - we still have a long way to go.This presentation won't be technical, it aims to provide insight into our experience as we continue to develop our incident management capabilities. It aims to provide useful elements for incident response practitioners (particularly those focusing on tooling) as well as team leads and managers.