💼 SI-4 System Monitoring

• Contextual name: 💼 SI-4 System Monitoring
• ID: /frameworks/nist-sp-800-53-r5/si/04
• Located in: 💼 SI System And Information Integrity

Description

a. Monitor the system to detect:

1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]; and
2. Unauthorized local, network, and remote connections; b. Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods]; c. Invoke internal monitoring capabilities or deploy monitoring devices:
3. Strategically within the system to collect organization-determined essential information; and
4. At ad hoc locations within the system to track specific types of transactions of interest to the organization; d. Analyze detected events and anomalies; e. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation; f. Obtain legal opinion regarding system monitoring activities; and g. Provide [Assignment: organization-defined system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]].

Similar

• Sections
  • /frameworks/aws-fsbp-v1.0.0/cloudtrail/04
  • /frameworks/aws-fsbp-v1.0.0/codebuild/04
  • /frameworks/aws-fsbp-v1.0.0/ec2/51
  • /frameworks/aws-fsbp-v1.0.0/eks/08
  • /frameworks/aws-fsbp-v1.0.0/guardduty/01
  • /frameworks/aws-fsbp-v1.0.0/macie/01
  • /frameworks/aws-fsbp-v1.0.0/macie/02
  • /frameworks/aws-fsbp-v1.0.0/mq/02
  • /frameworks/aws-fsbp-v1.0.0/network-firewall/02
  • /frameworks/aws-fsbp-v1.0.0/transfer-family/03
• Internal
  • ID: dec-c-a8e96a81

Similar Sections (Take Policies From)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [CloudTrail.4] CloudTrail log file validation should be enabled		1	1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [CodeBuild.4] CodeBuild project environments should have a logging AWS Configuration
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.51] EC2 Client VPN endpoints should have client connection logging enabled
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EKS.8] EKS clusters should have audit logging enabled
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [GuardDuty.1] GuardDuty should be enabled
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Macie.1] Amazon Macie should be enabled
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Macie.2] Macie automated sensitive data discovery should be enabled
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [NetworkFirewall.2] Network Firewall logging should be enabled
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Transfer.3] Transfer Family connectors should have logging enabled

Similar Sections (Give Policies To)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 FedRAMP High Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)	14	50	54
💼 FedRAMP Low Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)			7
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities			31
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources			46
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			118
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events			31
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			137
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations			20
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties			33
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities			34
💼 NIST CSF v2.0 → 💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded			26
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			117
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			97
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected			111

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 SI-4(1) System Monitoring _ System-wide Intrusion Detection System
💼 SI-4(2) System Monitoring _ Automated Tools and Mechanisms for Real-time Analysis
💼 SI-4(3) System Monitoring _ Automated Tool and Mechanism Integration
💼 SI-4(4) System Monitoring _ Inbound and Outbound Communications Traffic		1	1
💼 SI-4(5) System Monitoring _ System-generated Alerts
💼 SI-4(6) System Monitoring _ Restrict Non-privileged Users
💼 SI-4(7) System Monitoring _ Automated Response to Suspicious Events
💼 SI-4(8) System Monitoring _ Protection of Monitoring Information
💼 SI-4(9) System Monitoring _ Testing of Monitoring Tools and Mechanisms
💼 SI-4(10) System Monitoring _ Visibility of Encrypted Communications
💼 SI-4(11) System Monitoring _ Analyze Communications Traffic Anomalies
💼 SI-4(12) System Monitoring _ Automated Organization-generated Alerts
💼 SI-4(13) System Monitoring _ Analyze Traffic and Event Patterns
💼 SI-4(14) System Monitoring _ Wireless Intrusion Detection
💼 SI-4(15) System Monitoring _ Wireless to Wireline Communications
💼 SI-4(16) System Monitoring _ Correlate Monitoring Information
💼 SI-4(17) System Monitoring _ Integrated Situational Awareness
💼 SI-4(18) System Monitoring _ Analyze Traffic and Covert Exfiltration
💼 SI-4(19) System Monitoring _ Risk for Individuals
💼 SI-4(20) System Monitoring _ Privileged Users			5
💼 SI-4(21) System Monitoring _ Probationary Periods
💼 SI-4(22) System Monitoring _ Unauthorized Network Services
💼 SI-4(23) System Monitoring _ Host-based Devices
💼 SI-4(24) System Monitoring _ Indicators of Compromise
💼 SI-4(25) System Monitoring _ Optimize Network Traffic Analysis

Policies (2)

Policy	Logic Count	Flags
📝 AWS CloudTrail Log File Validation is not enabled 🟢	1	🟢 x6
📝 Google GCE Subnetwork Flow Logs are not enabled 🟢	1	🟢 x6