Risk analysis information (RISK-3d) is used to identify indicators of anomalous activity
Context and Guidance: Logging activities (SITUATION-1a, SITUATION-1b) and monitoring and analysis requirements (SITUATION-2c) are enhanced to incorporate relevant information from risk analysis activities (RISK-3d). Monitoring staff regularly review the risk analysis information and either modify existing indicators of anomalous activity or develop additional ones based on updates regarding threats, vulnerabilities, and identified risks.
Related Practices • Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: SITUATION-2d, SITUATION-2h, SITUATION-2i.