CSF 2.0 outcome: potentially adverse events are analyzed to better understand associated activities. Priority High. R1: use tools such as SIEM and SOAR to monitor log events continuously for known malicious and suspicious activity and report findings. R2: use current CTI in log analysis tools to improve accuracy and characterize threat actors, methods and indicators of compromise. R3: regularly review log events manually for technologies that automation cannot monitor sufficiently.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.