Symantec Data Center Security: How do you confirm an intrusion

Hello everyone,

I have been using SEP for years. It is obvious when a risk or threat is detected. It is identifed in the logs and you may get a pop-up.

I have recently started using Symantec Data Center Security. From what it looks like there are MANY events generated. Out of all of these events how do you identify that you actually have an intrussion incident as opposed to one of 10,000 other benign logged event?

Kind regards

Cameron