A collection of two or more incidents with matching criteria, which are combinations of destination host, source host, category, or customer identifier.