NIST:Detect

The Detect core function of the NIST framework focuses on the timely detection of cyber threats and incidents. This includes setting up systems and processes to detect, analyze and report suspicious activity so that quick action can be taken to reduce the impact of an incident. The core function “Detect” is important because it helps to quickly detect and respond to an incident, reducing the impact of an incident.

This includes:

• Implementing monitoring and detection systems to detect suspicious activity.
• Using advanced analytics to analyze and verify suspicious activity.
• Establish incident response plans and procedures to quickly respond to an incident detection.
• Testing detection and response capabilities to ensure they are adequate.