Netflow and IDS (intrusion detection system) are the two tools used for incident detection can be used to detect anomalous behavior, to detect command and control traffic, and to detect infected hosts.
The Netflow is CISCO feature used for collecting IP traffic information and monitoring network traffic on a specific interface. Similar to this, IDS is an application that monitors a network or systems for malicious activity or policy violations.