Operate detection and analysis per NIST SP 800-61 Rev 2 Section 3.2 (Detection and Analysis). Tasks include (a) Attack vectors as taxonomy (External/Removable Media + Attrition + Web + Email + Improper Usage + Loss or Theft of Equipment + Other) for categorisation per Section 3.2.1, (b) Signs of an Incident: precursors and indicators monitored across SIEM + IDS/IPS + antimalware + log management + file integrity monitoring + third-party monitoring services + public information sources + people-reported indicators per Section 3.2.2, (c) Sources of Precursors and Indicators inventory per Section 3.2.3, (d) Incident Analysis including network and system profiling + understand normal behaviour + create log retention policy + perform event correlation + keep all host clocks synchronised + use a knowledge base + use Internet search engines for research + run packet sniffers to collect additional data + filter the data + seek assistance from others per Section 3.2.4, (e) Incident Documentation: status + summary + indicators + related incidents + actions taken + chain of custody + impact assessment + contact information + list of evidence gathered + comments from handlers + next steps per Section 3.2.5, (f) Incident Prioritisation by functional impact + information impact + recoverability effort per Section 3.2.6 with predefined matrices, (g) Incident Notification: who to notify with what content and via what channel per Section 3.2.7.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.