RS.AN-01
Does your organization have a documented process for investigating notifications from security detection systems?
Explanation
Investigating detection alerts is the subject, specifically whether you have a documented process for following up on notifications from systems such as IDS, SIEM, or EDR. Proper investigation of these notifications is crucial for identifying potential security incidents, determining their scope and impact, and initiating appropriate response actions.
Evidence could include an incident response playbook that outlines the investigation process, documentation of alert triage procedures, or logs showing alert investigations with timestamps and outcomes. Screenshots of your security operations dashboard showing alert handling workflows would also serve as suitable evidence.
Context
- Function
- RS: RESPOND
- Category
- RS.AN: Incident Analysis
- Sub-Category
- Notifications from detection systems are investigated
Related questions
- Does your organization have a formal process to assess and document the impact of security incidents?
- Does your organization have a documented process for reconstructing the chronological sequence of security incidents, including all affected assets and resources?
- Does your incident response process include identification and analysis of vulnerabilities, threats, and threat actors involved in security incidents?
- Does your organization conduct root cause analysis to identify systemic issues when investigating security incidents?
- Does your organization utilize cyber deception technologies to gather intelligence on attacker behavior and tactics?
- Does your organization categorize security incidents according to established incident response plans?