A common definition that identifies and classifies cyber incidents has not as yet been accepted to take hold in theoretical works and strategic documents of the developed countries. The origin of such incidents may vary, which means that they may be motivated by criminal or political factors, derived from terrorism, as well as sponsored by some states with a view of achieving particular economic, political, military and national security objectives. The experiences gained so far suggest that the problem essentially lies in the fact that the leading countries have taken different political and legal approaches to this issue. They have stemmed from different interests of the global actors in connection with the use of cyberspace for achieving their respective goals at the national and international level. This work sets out a proposal for a definition that implies the following: a cyber attack can be carried out by state or non-state actors; it must involve active behaviour of the perpetrator; it must aim to jeopardize the functioning of the victim's computer network and be carried out with the aim of achieving a political or national security goal. The offered theoretical framework for the division of the intelligence work in cyberspace into active and passive activities fits in inherently with the classification of criminal offences in cyberspace, as set out in the Council of Europe Convention on Cyber-Crime and the Criminal Code of the Republic of Serbia.