1. What role do end users play in incident reporting? Should end users be encouraged to report suspicious occurrences? Why or why not?
What kind of user training should be conducted to deal with the issue of noise. How do you strike a balance between being overwhelmed with false positives and the danger of ignoring true incidents?