DE.AE-02 Adverse event analysis
Analyzing potentially adverse events to understand the associated activity, using SIEM monitoring, threat intelligence in log analysis and manual review where automation falls short.
DE.AE Adverse event analysis
Adverse Event Analysis: analyzing and correlating events, estimating impact, distributing event information, integrating threat intelligence and declaring incidents; six Subcategories.
DE.AE-03 Event correlation
Correlating information from multiple sources: centralizing logs on a small number of log servers, event correlation technology such as a SIEM, and threat intelligence to link events.
DE.AE-04 Impact and scope estimation
Estimating the impact and scope of adverse events, either with tools such as a SIEM or by analyst judgment, and refining the estimates.
DE.AE-06 Event information to staff and tools
Getting information on adverse events to authorized staff and tools: alerts to the SOC and incident responders, constant access to findings, and automatic or manual ticket creation.
DE.AE-07 Threat intelligence in analysis
Integrating threat intelligence, asset inventory data and vulnerability disclosures into detection and analysis.
DE.AE-08 Incident declaration
Declaring incidents when adverse events meet defined incident criteria, while accounting for known false positives; the handoff point from Detect to Respond.
