Which of the following is the MOST effective way to detect security incidents?