Operate log analysis per NIST SP 800-92 Chapter 5 (Operational Processes) + Section 5.12 (Performing Log Analysis). Correlation and detection rules per Section 5.12.1: implement correlation rules combining signals across sources (authentication + endpoint + network + identity + cloud + application) to detect compound attack patterns (credential stuffing + lateral movement + data exfiltration + insider misuse + supply chain compromise + ransomware staging) + maintain rule lifecycle (development + test + deployment + tuning + retirement) + track false positive and true positive rate + align rule coverage with MITRE ATTandCK. Baselining and anomaly detection per Section 5.12.2: capture normal behaviour baselines per user + asset + service + apply statistical or machine learning anomaly detection where signature-based detection is insufficient + manage model drift + bias + explainability. Alerting + triage + response workflow per Section 5.12.3: route alerts to case management with severity + priority + ownership + SLA + escalation + closure criteria + integrated with NIST SP 800-61 IR runbooks. Periodic manual log review per Section 5.12.4: schedule manual review of high-value low-volume logs (executive account activity + privileged admin actions + critical configuration changes + DLP triggers + sensitive data access) that automated rules may miss. Investigation and forensic search per Section 5.12.5: provide full-text search + structured filtering + time-series visualisation + saved investigations + chain-of-custody preserved query results for legal hold and investigation.
Maintained by Gerard Blokdyk·Verified against the published standard ·Control text last updated
What else in your programme already covers this
This control maps to 82 controls across 36 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.