DET-03 Cyber security incident identification
2 actions under this Detect principle in Essentials for enterprise IT. Each action links to plain-English guidance, audit tips and cross-framework mappings.
ASD principle statement
Cyber security events are analysed in a timely manner to identify cyber security incidents.
Quoted as published. Everything else on this page is written by Control Stack.
- Function
- Detect
- Domains
The two actions
- IT.DET-03.1Triage Alerts and Events Promptly Against Defined Incident Thresholds
Checks each security alert and event quickly to decide whether it meets the organisation's threshold for a cyber security incident.
Domains:Visibility and response - IT.DET-03.2Correlate Signals Across Identities, Applications, Data and Infrastructure to Identify Incidents
Spots cyber security incidents by linking clues from accounts, apps, data and systems, rather than relying on one alert alone.
Domains:Visibility and response
Back to the full ASD Essentials for enterprise IT action list, or browse the complete control library.