Skip to main content

💼 DE.AE-06: Information on adverse events is provided to authorized staff and tools

  • ID: /frameworks/nist-csf-v2.0/de-ae/06

Description​

  1. Use cybersecurity software to generate alerts and provide them to the security operations center (SOC), incident responders, and incident response tools
  2. Incident responders and other authorized personnel can access log analysis findings at all times
  3. Automatically create and assign tickets in the organization's ticketing system when certain types of alerts occur
  4. Manually create and assign tickets in the organization's ticketing system when technical staff discover indicators of compromise

Similar​

  • Sections
    • /frameworks/nist-csf-v1.1/de-dp/04
    • /frameworks/nist-sp-800-53-r5/ir/04
    • /frameworks/nist-sp-800-53-r5/pm/15
    • /frameworks/nist-sp-800-53-r5/pm/16
    • /frameworks/nist-sp-800-53-r5/ra/03
    • /frameworks/nist-sp-800-53-r5/ra/10

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 NIST CSF v1.1 → 💼 DE.DP-4: Event detection information is communicated2933no data
💼 NIST SP 800-53 Revision 5 → 💼 IR-4 Incident Handling151no data
💼 NIST SP 800-53 Revision 5 → 💼 PM-15 Security and Privacy Groups and Associationsno data
💼 NIST SP 800-53 Revision 5 → 💼 PM-16 Threat Awareness Program1no data
💼 NIST SP 800-53 Revision 5 → 💼 RA-3 Risk Assessment41no data
💼 NIST SP 800-53 Revision 5 → 💼 RA-10 Threat Huntingno data

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance

Policies (33)​

PolicyLogic CountFlagsCompliance
🛡️ AWS Account IAM Access Analyzer is not enabled for all regions🟢1🟢 x6no data
🛡️ AWS CloudTrail Log File Validation is not enabled🟢1🟢 x6no data
🛡️ AWS CloudTrail S3 Bucket Access Logging is not enabled.🟢1🟢 x6no data
🛡️ AWS KMS Symmetric CMK Rotation is not enabled🟢1🟢 x6no data
🛡️ AWS S3 Bucket Server Access Logging is not enabled🟢1🟢 x6no data
🛡️ AWS VPC Flow Logs are not enabled🟢1🟠 x1, 🟢 x5no data
🛡️ Azure Diagnostic Setting for Azure Key Vault is not enabled🟢⚪🟢 x2, ⚪ x1no data
🛡️ Azure PostgreSQL Flexible Server connection_throttle.enable Parameter is not set to ON🟢1🟢 x6no data
🛡️ Azure PostgreSQL Flexible Server log_checkpoints Parameter is not set to ON🟢1🟢 x6no data
🛡️ Azure PostgreSQL Flexible Server log_retention_days Parameter is less than 4 days🟢1🟢 x6no data
🛡️ Azure PostgreSQL Single Server log_connections Parameter is not set to ON🟢1🟢 x6no data
🛡️ Azure PostgreSQL Single Server log_disconnections Parameter is not set to ON🟢1🟢 x6no data
🛡️ Azure SQL Server Auditing is not enabled🟢1🟢 x6no data
🛡️ Azure SQL Server Auditing Retention is less than 90 days🟢1🟢 x6no data
🛡️ Azure Storage Blob Logging is not enabled for Read, Write, and Delete requests🟢1🟢 x6no data
🛡️ Azure Storage Queue Logging is not enabled for Read, Write, and Delete requests🟢1🟢 x6no data
🛡️ Azure Subscription Activity Log Alert for Create or Update Network Security Group does not exist🟢1🟢 x6no data
🛡️ Azure Subscription Activity Log Alert for Create or Update Security Solution does not exist🟢1🟢 x6no data
🛡️ Azure Subscription Activity Log Alert for Create Policy Assignment does not exist🟢1🟢 x6no data
🛡️ Azure Subscription Activity Log Alert for Delete Network Security Group does not exist🟢1🟢 x6no data
🛡️ Azure Subscription Activity Log Alert for Delete Policy Assignment does not exist🟢1🟢 x6no data
🛡️ Azure Subscription Activity Log Alert for Delete Security Solution does not exist🟢1🟢 x6no data
🛡️ Azure Subscription Integration With Microsoft Defender For Cloud Apps is not enabled🟢1🟢 x6no data
🛡️ Azure Subscription Microsoft Defender For (Managed Instance) Azure SQL Databases is not set to On🟢1🟢 x6no data
🛡️ Azure Subscription Microsoft Defender For App Services is not set to On🟢1🟢 x6no data
🛡️ Azure Subscription Microsoft Defender For Containers is not set to On🟢1🟢 x6no data
🛡️ Azure Subscription Microsoft Defender For Key Vault is not set to On🟢1🟢 x6no data
🛡️ Azure Subscription Microsoft Defender For Servers is not set to On🟢1🟢 x6no data
🛡️ Azure Subscription Microsoft Defender For SQL Servers On Machines is not set to On🟢1🟢 x6no data
🛡️ Azure Subscription Microsoft Defender For Storage is not set to On🟢1🟢 x6no data
🛡️ Azure Subscription Security Alert Notifications additional email address is not configured🟢1🟢 x6no data
🛡️ Azure Subscription Security Alert Notifications to subscription owners are not configured🟢1🟢 x6no data
🛡️ Google GCE Firewall Rule logging is disabled🟢1🟢 x6no data