...but all levels of your IT staff should be aware of how to report incidents internally. End users should report suspiciousactivity to the IT staff directly or through a help desk rather than directly to the CSIRT. Every team member should...
http://technet.microsoft.com/library/cc700825.aspx