DE.AE-02.291
Does your organization integrate current cyber threat intelligence feeds into your log analysis and monitoring tools?
Explanation
Integrating threat intelligence into log analysis tools enhances detection capabilities by providing context about known malicious indicators, attack patterns, and threat actor behaviors. This allows security teams to prioritize alerts based on real-world threat data and identify sophisticated attacks that might otherwise go undetected. Evidence could include screenshots of SIEM or log analysis platforms showing integrated threat feeds, documentation of threat intelligence sources and how they're incorporated into detection rules, or reports demonstrating how threat intelligence improved incident detection or investigation.
Implementation Example
Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise
ID: DE.AE-02.291
Context
- Function
- DE: DETECT
- Category
- DE.AE: Adverse Event Analysis
- Sub-Category
- Potentially adverse events are analyzed to better understand associated activities
