SI-4(13): Analyze Traffic and Event Patterns
CSF v1.1 References:
(Not part of any baseline)
- NIST Special Publication 800-53 Revision 4:
- SI-4(13): Analyze Traffic / Event Patterns
- Analyze communications traffic and event patterns for the system;
- Develop profiles representing common traffic and event patterns; and
- Use the traffic and event profiles in tuning system-monitoring devices.
Identifying and understanding common communications traffic and event patterns help organizations provide useful information to system monitoring devices to more effectively identify suspicious or anomalous traffic and events when they occur. Such information can help reduce the number of false positives and false negatives during system monitoring.