Critical Control 1: Inventory of Authorized and Unauthorized Devices
Critical Control 11: Account Monitoring and Control
Abnormal account activity can only be detected when compared to a baseline of known good activity. The baseline to meet this control should be recorded by the SIEM; and, as future snapshots or baselines are recorded, they can be compared to the approved baseline in the SIEM.
Critical Control 12: Malware Defenses
Malware that is discovered should be recorded according to this control. Centralized anti-malware tools should report their findings to a SIEM, which correlates against system and vulnerability data to determine which systems pose a greater risk due to the malware discovered on that system
Critical Control 13: Limitation and Control of Network Ports, Protocols, and Services
if a system has a running port, protocol, or service that has not been authorized, it should also be reported to a central source where these vulnerabilities can be correlated with other events concerning a particular system. SIEMs can monitor log data to detect traffic over restricted ports, protocols, and services. Organizations can use these controls to decide which ports and services are useful for business, which are not, and which types of traffic and ports to limit
Critical Control 14: Wireless Device Control
Device misconfigurations and wireless intrusions should be reported to a central database for incident handling purposes. A SIEM is a perfect candidate to consolidate this information and use it for correlation or detection of threats to wireless infrastructure
Critical Control 15: Data Loss Prevention
data loss rule violations, like CCE discoveries, should also be reported to one central source such as a SIEM, which can correlate data loss events with inventory or asset information as well as other system and user activity to detect complex breaches of sensitive data.
Critical Control 15: Data Loss Prevention
data loss rule violations, like CCE discoveries, should also be reported to one central source such as a SIEM, which can correlate data loss events with inventory or asset information as well as other system and user activity to detect complex breaches of sensitive data.
