[juancn]

But it could be a third party with no access other than the intrusion signal.

You run the intrusion detection, and then your hired goons start attacking the attacker.