Detections
Analytics
CSCv6|6.6
Title
Deploy a SIEM (Security Information and Event Management) or log analytic tools for log aggregation and consolidation from multiple machines and for log correlation and analysis.Description
Deploy a SIEM (Security Information and Event Management) or log analytic tools for log aggregation and consolidation from multiple machines and for log correlation and analysis. Using the SIEM tool, system administrators and security personnel should devise profiles of common events from given systems so that they can tune detection to focus on unusual activity, avoid false positives, more rapidly identify anomalies, and prevent overwhelming analysts with insignificant alerts.Reference Item Details
Reference: CIS Critical Security Controls v6
Category: Maintenance, Monitoring, and Analysis of Audit Logs
Family: System
Audit Items
View all Reference Audit Items