Intrusion Reporting and Response. Users forward firewall logs that are aggregated and analysed to identify incidents that are reported to the responsible party.