During a review of NIST SP 800-61 concepts, an analyst is categorizing signs of incidents. Their SIEM logs a vulnerability scanner sweeping the organization's external IP range from an unknown source. According to NIST SP 800-61, how should this observation be classified?