+DER.1.A11 Use of a Central Logging Infrastructure to Evaluate Security-Relevant Events [Process Owner] (S)

DER.1.A11 Use of a Central Logging Infrastructure to Evaluate Security-Relevant Events [Process Owner] (S)

Event messages that are generated by IT systems and applications and stored on a central logging infrastructure (see OPS.1.1.5 Logging) SHOULD be retrievable using a tool. The selected tool SHOULD be able to analyse the messages. The collected event messages SHOULD be checked for anomalies at regular intervals. The signatures of the detection systems used SHOULD always be identically up to date so that security-relevant events can also be detected retrospectively.

1. Преглед

1.1 Препратки

1.2 Идентифицирани изисквания

1.3 Свързани регулации

2. Идентифицирани изисквания

Изисквания

3. Свързани регулации

Регулации

Свързани задачи

Връзки
blocks G 0.29 Violations of Laws or Regulations
blocks G 0.39 Malware