DE.AE-02 Potentially adverse events are analyzed to better understand associated activities

Statement

Potentially adverse events are analyzed to better understand associated activities

Guidance

Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity

Guidance

Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise

Guidance

Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation

Guidance

Use log analysis tools to generate reports on their findings

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final