IR-4(14)_security-operations-center
Establish and maintain a security operations center.
Browse reusable Agent Skills, each with a clear purpose and practical guidance.
Establish and maintain a security operations center.
Include the following types of dynamic reconfiguration for [organization-defined] as part of the incident response capability: [organization-defined].
Identify [organization-defined] and take the following actions in response to those incidents to ensure continuation of organizational mission and bus
Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.
Implement a configurable capability to automatically disable the system if [organization-defined] are detected.
Implement an incident handling capability for incidents involving insider threats.
Coordinate an incident handling capability for insider threats that includes the following organizational entities [organization-defined].
Employ [organization-defined] to respond to incidents.
Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and ...
Track incidents and collect and analyze incident information using [organization-defined].