SI-4(13): Analyze Traffic and Event Patterns

Threats Addressed:


(Not part of any baseline)

Previous Version:

Control Statement

  1. Analyze communications traffic and event patterns for the system;
  2. Develop profiles representing common traffic and event patterns; and
  3. Use the traffic and event profiles in tuning system-monitoring devices.

Supplemental Guidance

Identifying and understanding common communications traffic and event patterns help organizations provide useful information to system monitoring devices to more effectively identify suspicious or anomalous traffic and events when they occur. Such information can help reduce the number of false positives and false negatives during system monitoring.