NIST SP 800-92 5: Log Analysis: Correlation, Baselining, Anomaly Detection, Alerting, Manual Review

Operate log analysis per NIST SP 800-92 Chapter 5 (Operational Processes) + Section 5.12 (Performing Log Analysis). Correlation and detection rules per Section 5.12.1: implement correlation rules combining signals across sources (authentication + endpoint + network + identity + cloud + application) to detect compound attack patterns (credential stuffing + lateral movement + data exfiltration + insider misuse + supply chain compromise + ransomware staging) + maintain rule lifecycle (development + test + deployment + tuning + retirement) + track false positive and true positive rate + align rule coverage with MITRE ATTandCK. Baselining and anomaly detection per Section 5.12.2: capture normal behaviour baselines per user + asset + service + apply statistical or machine learning anomaly detection where signature-based detection is insufficient + manage model drift + bias + explainability. Alerting + triage + response workflow per Section 5.12.3: route alerts to case management with severity + priority + ownership + SLA + escalation + closure criteria + integrated with NIST SP 800-61 IR runbooks. Periodic manual log review per Section 5.12.4: schedule manual review of high-value low-volume logs (executive account activity + privileged admin actions + critical configuration changes + DLP triggers + sensitive data access) that automated rules may miss. Investigation and forensic search per Section 5.12.5: provide full-text search + structured filtering + time-series visualisation + saved investigations + chain-of-custody preserved query results for legal hold and investigation.