SANS Incident Handler's Handbook and PICERL Methodology PICERL-P-04: Preparation: Logging, Detection, and Telemetry Baseline

Ensure required log sources are forwarded, retained, and time synchronised, with detection content tuned to known threat patterns and coverage gaps tracked.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Preparation

PICERL-P-01 Preparation: Incident Response Policy and Charter
PICERL-P-02 Preparation: Incident Response Team Roles and Skills
PICERL-P-03 Preparation: Jump Kit and Tooling Readiness
PICERL-P-05 Preparation: Tabletop Exercises and Drills

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All SANS Incident Handler's Handbook and PICERL Methodology controls