An incident identifier is a tracking label assigned to a report, claim, ticket, or case so different teams and systems can refer to the same event. It may be a case number, a hash-like string, or another unique code used by threat-intelligence platforms, SOC tools, and reporting workflows.
In cyber security, incident identifiers matter because they reduce confusion when multiple posts, alerts, or indicators describe the same alleged breach. Analysts use them to correlate logs, notes, and evidence across tools, and to separate repeated rumors from one verified incident. Attackers sometimes include an identifier in a leak post or extortion message to make a claim easier to track and reuse. Defenders treat the label as a pointer, not proof: it helps organize investigation, but confirmation still requires logs, forensic evidence, and impact analysis.