What to Provide
(1) The documented policy/procedure that defines your organization's process for utilizing an Intrusion Detection System (IDS).
(2) A screenshot of an example notification or alert message from your IDS.
(3) A screenshot of the IDS dashboard and associated configurations.
Evidence Format
(1) Word/PDF document
(2) Screenshots or exported images in a common image file type, such as .jpg, .png, or .pdf.
(3) Screenshots or exported images in a common image file type, such as .jpg, .png, or .pdf.
Additional Guidance
(1) The evidence should demonstrate:
The use of IDS tools you use for in-scope production systems
What alerts are in place and how are they sent
Who is notified for any needed investigation
How security breaches are remediated
How you notify affected parties
(2) The example notification should have occurred within the audit period.
(3) This evidence should demonstrate:
What is being monitored
What will trigger a notification
Who receives notification and how
Commonly used IDS tools include:
AWS GuardDuty
Azure Defender
Google Cloud IDS
Cisco SourceFire
Example Evidence
AWS GuardDuty
GCP Cloud IDS
Azure Defender
Azure Firewall IDS
Associated Unified Control ID | Associated Framework Control |
CTRL-833 | LCL-42 |