AWS Well-Architected Security Pillar
Detection

AWS Well-Architected Security Pillar SEC04-BP03: Correlate and enrich security alerts

Enrich findings with asset, identity, business owner and threat intel context so responders can triage quickly, and correlate signals across GuardDuty, Security Hub and other tools.

What else in your programme already covers this

This control maps to 74 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 6 controls

  • AC-2(12) Account Monitoring for Atypical Usage
  • AU-6 Audit Record Review, Analysis, and Reporting
  • AU-6(1) Automated Process Integration
  • AU-6(3) Correlate Audit Record Repositories
  • SI-4(16) System Monitoring | Correlate Monitoring Information. Correlate information from monitoring tools and mechanisms employed throughout the system
  • SI-4(5) System-Generated Alerts

FedRAMP Moderate · 6 controls

  • AC-2(12) Account Monitoring for Atypical Usage
  • AU-6 Audit Record Review, Analysis, and Reporting
  • AU-6(1) Automated Process Integration
  • AU-6(3) Correlate Audit Record Repositories
  • SI-4(16) System Monitoring | Correlate Monitoring Information. Correlate information from monitoring tools and mechanisms employed throughout the system
  • SI-4(5) System-Generated Alerts

Azure Security Benchmark · 5 controls

  • ASBv3-IR-3 Detection and analysis - create incidents based on high-quality alerts
  • ASBv3-IR-5 Detection and analysis - prioritize incidents
  • ASBv3-LT-1 Enable threat detection capabilities
  • DP-2 Monitor anomalies and threats targeting sensitive data
  • LT-5 Centralize security log management and analysis

CMMC 2.0 · 5 controls

NIST Cybersecurity Framework 2.0 · 5 controls

  • NIST-CSF-DE.AE-02 Potentially adverse events are analyzed to better understand associated activities
  • NIST-CSF-DE.AE-03 Information is correlated from multiple sources
  • NIST-CSF-DE.AE-04 The estimated impact and scope of adverse events are understood
  • NIST-CSF-DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis
  • NIST-CSF-RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

NIST SP 800-161 Rev 1 · 4 controls

NIST SP 800-53 Revision 5.1 HIGH · 4 controls

  • AC-2(12) Account Monitoring for Atypical Usage
  • AU-6 Audit Record Review, Analysis, and Reporting
  • AU-6(1) Automated Process Integration
  • AU-6(3) Correlate Audit Record Repositories

PCI DSS 4.0 · 4 controls

  • 10.4.1 Daily log review for critical systems
  • 10.4.1.1 Automated mechanisms for log review
  • 10.4.3 Exceptions and anomalies addressed
  • 12.10.5 IRP includes monitoring and response to security control alerts

CIS Controls v8 · 3 controls

  • CIS-13.1 Centralize Security Event Alerting
  • CIS-13.11 Tune Security Event Alerting Thresholds
  • CIS-8.11 Conduct Audit Log Reviews

ISO 27002:2022 · 3 controls

  • 5.25 Assessment and decision on information security events
  • 5.7 Threat intelligence
  • 8.16 Monitoring activities

NIST SP 800-171 Rev 3 · 3 controls

  • 03.03.05 Audit Record Review, Analysis, and Reporting
  • 03.03.06 Audit Record Reduction and Report Generation
  • 03.14.06 System Monitoring

NIST SP 800-53 Rev 5 · 3 controls

NIST SP 800-53 Rev 5 MODERATE · 3 controls

  • AU-6 Audit Record Review, Analysis, and Reporting
  • AU-6(1) Automated Process Integration
  • AU-6(3) Correlate Audit Record Repositories

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-28 Continuous incident detection and response (Excellent)
  • ASD37-31 Hunt to discover incidents (Very Good)

C5 (Germany) · 2 controls

  • C5-OPS-11 Logging and Monitoring - Metadata Management Concept
  • C5-OPS-13 Logging and Monitoring - Identification of Events

HIPAA Security Rule · 2 controls

ISO 27001:2022 · 2 controls

  • 5.25 Assessment and decision on information security events
  • 8.16 Monitoring activities

NIST SP 800-66 Rev 2 · 2 controls

SOC 2 · 2 controls

  • SOC2-CC7.2 Monitors system components for anomalies indicating malicious acts
  • SOC2-CC7.3 Evaluates security events to determine incident status

ACSC Essential Eight · 1 control

Australia Consumer Data Right - Banking (CDR) · 1 control

ISO 27701:2019 · 1 control

  • 6.9.4 Logging and monitoring

NIST SP 800-53 Rev 5 LOW · 1 control

  • AU-6 Audit Record Review, Analysis, and Reporting

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Detection

You are reading one control. How much of AWS Well-Architected Security Pillar have you already done?

AWS Well-Architected Security Pillar SEC04-BP03 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of AWS Well-Architected Security Pillar your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 52 of 63 AWS Well-Architected Security Pillar controls already carry evidence.

If you hold NIST SP 800-53 Rev 582.5% covered · 11 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.174.6% covered · 16 gapsIf you hold ISO 27002:202273% covered · 17 gapsIf you hold FedRAMP Moderate69.8% covered · 19 gapsIf you hold Azure Security Benchmark65.1% covered · 22 gapsIf you hold PCI DSS 4.063.5% covered · 23 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 74 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll AWS Well-Architected Security Pillar controls