The Idea(s)
I propose:
"Just" automated detection is not enough anymore (when even the notion of reliable automated detection is still considered by many difficult/impossible/futuristic etc.)--detected events need to be reduced to actionable events, and actionable events need to trigger immediate (automated) response whenever possible.
The co-stimulation metaphor from immunology can be applied to automated systems to improve confidence that detected anomalies truly indicate a real attack by correlating attributes of system state at the time the anomaly is detected.