Organisational policy that defines the requirements for the configuration, classification, response SLAs, escalation, runbooks and calibration of security and operational alerts, including the prevention of alert fatigue and quality metrics, proportional to the criticality level (L1, L2, L3).
Specifics of exception management in the context of monitoring and operations - alert silencing, log retention and regulatory implications
Integration with SIEM systems for parsing, visualisation and correlation of events.
Technical and operational indicators for the assessment of the effectiveness of the security monitoring programme, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.
Use of MITRE ATT&CK as the reference vocabulary for detection engineering — mapping of detections to adversarial techniques and tactics and measurement of coverage. ATT&CK is a shared vocabulary and a threat-informed reference, not a complete authority nor a checklist for total coverage.
Canonical catalogue of requirements for the security monitoring and operations programme (OPS-001 to OPS-017), with applicability by risk level and acceptance criteria for centralised logging, critical events, retention, SIEM, alerts, response SLA, correlation, integration with the IRP, behavioural detection, effectiveness metrics and continuous operational health signals, backups with tested restore and recovery of the application.
Organisational policy that defines the requirements for security monitoring in production, including the definition of critical events, SIEM integration, behavioural correlation, coverage of monitoring domains and periodic review of detection rules, proportional to the criticality level (L1, L2, L3).
Organisational policy that defines the requirements for the production, formatting, centralisation, retention and protection of application and security logs, including a minimum event schema, mandatory events, masking of sensitive data, immutability and SIEM integration, proportional to the criticality level (L1, L2, L3).