The stream of logged events is examined and filtered to identify only those abnormal events for which a response is needed. These remaining events, designated as significant events, indicate an abnormal state of an MO. This set of significant events requires a response from either Event Management activities or from the Incident Management process. This activity is also responsible for determining the appropriate time frame for event resolution.