A baseline of network operations and expected data flows for users and systems is established and managed
A baseline of network operations and expected data flows for users and systems is established and managed
Detected events are analyzed to understand attack targets and methods
Event data are collected and correlated from multiple sources and sensors
Impact of events is determined
Incident alert thresholds are established
The network is monitored to detect potential cybersecurity events
The physical environment is monitored to detect potential cybersecurity events
Personnel activity is monitored to detect potential cybersecurity events
Malicious code is detected
Unauthorized mobile code is detected