Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D > D.1.2 EVENT AND INCIDENT MANAGEMENT

D.1.2 EVENT AND INCIDENT MANAGEMENT

Event management involves monitoring and responding to as necessary, observable occurrences
in a network or system. A variety of tools and technologies exist to monitor events, such as
intrusion detection systems and logging mechanisms. Some tools may detect events based on
known attack signatures, while others detect anomalies in behavior or performance that could
indicate an attack. Certain events may signal that an incident has occurred, which is a violation or
imminent threat of violation of computer security policies, acceptable use policies, or standard
computer security practices. Incident management tools may assist in detecting, responding to,
and limiting the consequences of a malicious cyber attack against an organization.
A log is a record of the events occurring within an organization's systems and networks. Logs are
composed of log entries; each entry contains information related to a specific event that has
occurred within a system or system component. Many logs within an organization contain records
related to computer security. These computer security logs can be generated by many sources,
including security software such as malware protection software, firewalls, and intrusion
detection and prevention systems, operating systems on servers, workstations, networking
equipment, and applications.47
The number, volume, and variety of security logs have increased greatly, which has created the
need for information system security log management - the process of generating, transmitting,
storing, analyzing, and disposing of security log data. Log management is essential for ensuring
that security records are stored in sufficient detail for an appropriate period of time. Logs are a
key resource when performing auditing and forensic analysis, supporting internal investigations,
establishing baselines, and identifying operational trends and long-term problems. Routine log
analysis is beneficial for identifying security incidents, policy violations, fraudulent activity, and
operational problems, and as such, supports an ISCM capability.
The implementation and effective use of logging and log management tools and technologies can
assist organizations in automating the implementation, assessment, and continuous monitoring of
several NIST SP 800-53 security controls including AU-2, Auditable Events; AU-3, Content of
Audit Records; AU-4, Audit Storage Capacity; AU-5, Response to Audit Processing Failures;
AU-6, Audit Review, Analysis, and Reporting; AU-7, Audit Reduction and Report Generation;
AU-8, Time Stamps; AU-12, Audit Generation; CA-2, Security Assessments; CA-7, Continuous
Monitoring; IR-5, Incident Monitoring; RA-3, Risk Assessment; and SI-4, Information system
Monitoring.
Intrusion detection is the process of monitoring the events occurring in a computer system or
network and analyzing them for signs of possible incidents, which are violations or imminent
Management Program.
47 For more information, please refer to NIST SP 800-92, Guide to Computer Security Log Management.