What exactly is a sysadmin/security officers job

["Jim Leo" <admin () everett pitt cc nc us>]

I've really enjoyed the Out-sourcing vs In-house debate thus far. 
However, I'm curious, just exactly what do most of the 
list-subscribers do when an attempt at intrusion occurs? Exactly what 
is classified as an intrusion. Does using any one of the numerous 
scanning tools out there (asmodeous, ISS, strobe, etc) constitute an 
intrusion attempt, or just 'knob twiddling'? How does one deal with 
it. And yes I know about management policy, I'm curious just what 
others are doing in the security arena.
Jim Leo
admin () everett pitt cc nc us