3.2.4 The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate, the …

Requirement

The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate, the relevant entities shall lay down appropriate values for alarm thresholds. If the laid down values for alarm threshold are exceeded, an alarm shall be triggered, where appropriate, automatically. The relevant entities shall ensure that, in case of an alarm, a qualified and appropriate response is initiated in a timely manner.

Guidance

• Consider the use of anomaly detection or adaptive alarm thresholds to complement traditional static rules.
• Make sure that procedures are designed to detect network-based attacks based on anomalous inbound and outbound ingress or egress traffic patterns and/or denial of service (DoS) attacks, in a timely manner.
• Make sure that alarm thresholds, where appropriate, have been set in alignment with the results of the risk assessment carried out pursuant to point 2.1, covering at least the situations in point 3.2.3 of the Annex to the regulation. An indicative, non-exhaustive list of examples with thresholds (22) follows:
  • relevant outbound and inbound network traffic: traffic volume spikes exceeding 50% of normal traffic in a 10-minute period on a specific port;
  • access to systems and applications: three or more account lockouts within 15 minutes;
  • privileged access: two or more instances of privilege escalation (e.g. normal user to admin) within 24 hours (23);
  • antivirus: malware is detected on multiple endpoints within a short timeframe;
  • use of system resources: installations of unauthorised software within a short timeframe.

Examples of evidence

• Regular reports that summarize log data and highlight any anomalies detected.
• Alarm thresholds set.
• Records from past alarm triggers when thresholds were exceeded.
• Existing workflows that trigger event reporting (section 3.3).

1. Översikt

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

3. Relaterade regleringar

Länkade ärenden

• ENISA -