Attacks are detected. Foundational: attacks are detected at the endpoints and at the perimeter, backed by scanning of stored files, with false positives reduced through alert tuning. Intermediate: alerts are monitored 24/7 and the monitoring is tested regularly so that activity such as bulk exfiltration raises an immediate alert; the use of privileged and service accounts, and any escalation of their rights, is monitored with alerts raised where appropriate. Established: alerts are gathered together and examined for themes; abnormal user behaviour can be identified and alerted; outside partners test detection from time to time, for example through red team testing, FS-ISAC or STAR-FS. Advanced: dark web message boards and other threat actor communications are monitored for warning of targeting or signs of compromise, and measures such as phishing caught at the perimeter or reported by users, DDoS traffic volume and vishing activity are analysed proactively and thematically to spot targeted campaigns.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.