When unauthorized software is detected.
When a port scan is detected
When an unauthorized device is detected.