A wanted system is the logic that raises and manages response levels after suspicious or hostile activity is detected. In games, it controls how police attention escalates; in cyber security, the same idea appears in detection-and-response workflows that move from monitoring to alerting, blocking, or investigation. The system usually weighs triggers such as repeated failed logins, unusual network paths, privilege misuse, or policy violations, then assigns a severity level and decides what defensive action to take.
This matters because attackers try to stay below the threshold that causes a strong response. Defenders design wanted-style logic to correlate small signals into a meaningful incident, reduce false positives, and automate escalation. In real environments, the concept shows up in intrusion detection systems, SIEM correlation rules, account lockout policies, EDR containment, and SOC playbooks. A good wanted system is consistent, tunable, and hard to game; a weak one can be noisy, slow, or easy to evade.