Skip to main content

💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

  • ID: /frameworks/nist-csf-v2.0/de-ae/02

Description​

  1. Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity
  2. Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise
  3. Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation
  4. Use log analysis tools to generate reports on their findings

Similar​

  • Sections
    • /frameworks/nist-csf-v1.1/de-ae/02
    • /frameworks/nist-sp-800-53-r5/au/06
    • /frameworks/nist-sp-800-53-r5/ca/07
    • /frameworks/nist-sp-800-53-r5/ir/04
    • /frameworks/nist-sp-800-53-r5/si/04

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 NIST CSF v1.1 → 💼 DE.AE-2: Detected events are analyzed to understand attack targets and methods1824no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-6 Audit Record Review, Analysis, and Reporting10113no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-7 Continuous Monitoring613no data
💼 NIST SP 800-53 Revision 5 → 💼 IR-4 Incident Handling151no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4 System Monitoring25110no data

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance

Policies (35)​

PolicyLogic CountFlagsCompliance
🛡️ AWS Account Multi-Region CloudTrail is not enabled🟢1🟢 x6no data
🛡️ AWS API Gateway API Access Logging in CloudWatch is not enabled🟢1🟠 x1, 🟢 x5no data
🛡️ AWS API Gateway API Execution Logging in CloudWatch is not enabled🟢1🟢 x6no data
🛡️ AWS API Gateway REST API Stage X-Ray Tracing is not enabled🟢1🟢 x6no data
🛡️ AWS CloudFront Distribution Logging is not enabled🟢1🟢 x6no data
🛡️ AWS CloudTrail Log File Validation is not enabled🟢1🟢 x6no data
🛡️ AWS CloudTrail S3 Bucket Access Logging is not enabled.🟢1🟢 x6no data
🛡️ AWS CloudWatch Metric Alarm does not have any actions configured🟢1🟢 x6no data
🛡️ AWS DMS Migration Task Logging is not enabled🟢1🟢 x6no data
🛡️ AWS EC2 Auto Scaling Group behind ELB doesn't use ELB health check🟢1🟢 x6no data
🛡️ AWS Elastic Beanstalk Environment does not have enhanced health reporting enabled🟢1🟢 x6no data
🛡️ AWS GuardDuty is not enabled in all regions🟢1🟢 x6no data
🛡️ AWS KMS Symmetric CMK Rotation is not enabled🟢1🟢 x6no data
🛡️ AWS S3 Bucket Server Access Logging is not enabled🟢1🟢 x6no data
🛡️ AWS VPC Flow Logs are not enabled🟢1🟠 x1, 🟢 x5no data
🛡️ Azure Diagnostic Setting for Azure Key Vault is not enabled🟢⚪🟢 x2, ⚪ x1no data
🛡️ Azure PostgreSQL Flexible Server connection_throttle.enable Parameter is not set to ON🟢1🟢 x6no data
🛡️ Azure PostgreSQL Flexible Server log_checkpoints Parameter is not set to ON🟢1🟢 x6no data
🛡️ Azure PostgreSQL Flexible Server log_retention_days Parameter is less than 4 days🟢1🟢 x6no data
🛡️ Azure PostgreSQL Single Server log_connections Parameter is not set to ON🟢1🟢 x6no data
🛡️ Azure PostgreSQL Single Server log_disconnections Parameter is not set to ON🟢1🟢 x6no data
🛡️ Azure SQL Server Auditing is not enabled🟢1🟢 x6no data
🛡️ Azure SQL Server Auditing Retention is less than 90 days🟢1🟢 x6no data
🛡️ Azure Storage Blob Logging is not enabled for Read, Write, and Delete requests🟢1🟢 x6no data
🛡️ Azure Storage Queue Logging is not enabled for Read, Write, and Delete requests🟢1🟢 x6no data
🛡️ Azure Subscription Activity Log Alert for Create or Update Network Security Group does not exist🟢1🟢 x6no data
🛡️ Azure Subscription Activity Log Alert for Create or Update Security Solution does not exist🟢1🟢 x6no data
🛡️ Azure Subscription Activity Log Alert for Create Policy Assignment does not exist🟢1🟢 x6no data
🛡️ Azure Subscription Activity Log Alert for Delete Network Security Group does not exist🟢1🟢 x6no data
🛡️ Azure Subscription Activity Log Alert for Delete Policy Assignment does not exist🟢1🟢 x6no data
🛡️ Azure Subscription Activity Log Alert for Delete Security Solution does not exist🟢1🟢 x6no data
🛡️ Google Cloud Audit Logging is not configured properly🟢1🟢 x6no data
🛡️ Google GCE Firewall Rule logging is disabled🟢1🟢 x6no data
🛡️ Google GCE Network DNS Policy Logging is not enabled🟢1🟢 x6no data
🛡️ Google GCE Subnetwork Flow Logs are not enabled🟢1🟢 x6no data