Abstract: A method and an incident detection device in a local area network, an incident detection device being connected to the local area network by a wide area network, the local area network including a data conditioning and processing device, that: obtains, from the incident detection device, a processing repository for descriptive data from the connections between the stations and the nodes and descriptive data from the connections between the local area network nodes; aggregates the descriptive data from the connections between the stations and the nodes and the descriptive data from the connections between the nodes if the data processing repository includes information indicating that the data must be aggregated; calculates severity scores from the total severity scores according to the repository; and transfers aggregated data or severity scores to the incident detection device.