DE.AE Adverse Event Analysis

Statement

A baseline of network operations and expected data flows for users and systems is established and managed

Statement

Potentially adverse events are analyzed to better understand associated activities

Guidance

Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity

Guidance

Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise

Guidance

Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation

Guidance

Use log analysis tools to generate reports on their findings

Statement

Information is correlated from multiple sources

Guidance

Constantly transfer log data generated by other sources to a relatively small number of log servers

Guidance

Use event correlation technology (e.g., SIEM) to collect information captured by multiple sources

Guidance

Utilize cyber threat intelligence to help correlate events among log sources

Statement

The estimated impact and scope of adverse events are understood

Guidance

Use SIEMs or other tools to estimate impact and scope, and review and refine the estimates

Guidance

A person creates their own estimates of impact and scope

Statement

Incident alert thresholds are established

Statement

Information on adverse events is provided to authorized staff and tools

Guidance

Use cybersecurity software to generate alerts and provide them to the security operations center (SOC), incident responders, and incident response tools

Guidance

Incident responders and other authorized personnel can access log analysis findings at all times

Guidance

Automatically create and assign tickets in the organization's ticketing system when certain types of alerts occur

Guidance

Manually create and assign tickets in the organization's ticketing system when technical staff discover indicators of compromise

Statement

Cyber threat intelligence and other contextual information are integrated into the analysis

Guidance

Securely provide cyber threat intelligence feeds to detection technologies, processes, and personnel

Guidance

Securely provide information from asset inventories to detection technologies, processes, and personnel

Guidance

Rapidly acquire and analyze vulnerability disclosures for the organization's technologies from suppliers, vendors, and third-party security advisories

Statement

Incidents are declared when adverse events meet the defined incident criteria

Guidance

Apply incident criteria to known and assumed characteristics of activity in order to determine whether an incident should be declared

Guidance

Take known false positives into account when applying incident criteria