MON-005 Security Monitoring and Alerting
Description
Production systems are monitored for anomalous behaviour, security events, and indicators of compromise. Alerts are generated for defined threat scenarios and reviewed by a responsible team within defined SLAs. Alert thresholds, suppression rules, and escalation paths are documented.
Rationale
Logs without active review provide no detection capability. Structured alerting with documented response paths transforms log data into a real-time security control.
Framework Mappings (7)
| LOG-03 | Security Monitoring and Alerting | full |
| LOG-05 | Audit Logs Monitoring and Response | full |
| LOG-14 | Failures and Anomalies Reporting | full |
| 8.16 | Monitoring activities | full |
| AU-6 | Audit Record Review, Analysis, and Reporting | full |
| SI-4 | System Monitoring | full |
| CC7.2 | Monitors System Components for Anomalous Behavior | full |
Evidence (2)
SIEM alert rule configuration showing defined detection rules for threat scenarios, with documented alert thresholds, suppression rules, and escalation paths.
Example: SIEM detection rule library export (e.g., Splunk saved searches, Elastic SIEM rules, Sentinel analytics rules) showing rule names, trigger conditions, severity assignments, and assigned response queues
Test: Export the SIEM detection rule configuration. Verify: (1) rules exist for core threat scenarios (brute force, privilege escalation, impossible travel, data exfiltration indicators, configuration change); (2) each rule has a defined severity, escalation path, and assigned response owner; (3) suppression and tuning rules are documented and reviewed; (4) the rule set was last reviewed within the defined interval.
Alert queue records showing security monitoring alerts were reviewed and actioned within defined SLAs.
Example: Ticketing system (Jira, PagerDuty, or equivalent) records of SIEM-generated alerts for the preceding 30 days, showing alert type, creation time, acknowledgement time, and resolution time
Test: Query the alert queue or incident ticketing system for SIEM-generated alerts in the last 30 days. Verify: (1) alerts were acknowledged within the defined SLA for each severity level; (2) each alert has a documented triage decision; (3) calculate the percentage of alerts meeting the response SLA and confirm it is at or above the defined threshold.
Questions (3)
Are production systems monitored for anomalous behaviour and indicators of compromise, with alerts generated for defined threat scenarios and reviewed within defined SLAs?
Active monitoring requires both configured detection rules and a team responsible for reviewing and responding to alerts. Logs without active review provide no detection capability.
Which threat scenarios are covered by active detection rules in your SIEM or monitoring platform?
The first four categories are minimum expected coverage for a SaaS provider. All seven indicate a mature detection programme.
What is the defined SLA for acknowledging and triaging high severity security monitoring alerts?
24/7 coverage with a 1-hour or faster acknowledgement SLA is the expectation for high severity alerts in a production environment.