+OPS-13.02B

OPS-13.02B

The SIEM system is deployed within the cloud environment or externally and includes the following capabilities:

1. Standardisation of log data;

2. Automated analysis to identify and correlate potential security incidents;

3. Capabilities to detect unusual behaviour and potential threats;

4. Real-time alerting to inform the incident response team of critical events;

5. Reporting to the incident response team in case new information relevant to an event becomes available; and

6. Automated response mechanisms for addressing security incidents.

1. Overzicht

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

Eisen

3. Gerelateerde regelingen

Regelingen

Gekoppelde issues

Koppelingen
is blocked by System Generated Event Logs & Security-Relevant Telemetry
is blocked by Centralized Collection of Event Logs & Security-Relevant Telemetry
is blocked by Correlate Monitoring Information
is blocked by Anomalous Behavior
is blocked by Situational Awareness For Incidents
is blocked by Situational Awareness For Incidents
is blocked by Security Orchestration, Automation, and Response (SOAR)