[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fir-5":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ir-5","IR-5","Incident Monitoring",14,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Incidents must be tracked and documented.\n\n**In practice.** Doing this well means recording every incident in a tracking system with timeline, affected assets, classification, actions taken, evidence collected and closure details. The records support trend analysis, regulatory reporting and lessons learned. Auditors expect incident records, consistent classification and metrics derived from them. Records should show who handled each incident and when key decisions were made. Linking incidents to affected assets and root causes helps reveal recurring weaknesses and supports reporting to management and regulators.\n\n**Common gaps.** Incidents handled informally by chat or email often leave no proper record. Inconsistent classification makes trends and reporting unreliable. Near misses and minor incidents are often not recorded, hiding useful patterns.","Track and document incidents.\nDiscussion: Documenting incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics as well as evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources, including network monitoring, incident reports, incident response teams, user complaints, supply chain partners, audit monitoring, physical access monitoring, and user and administrator reports. [IR-4](#ir-4) provides information on the types of incidents that are appropriate for monitoring.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"zimbra-zero-day-exploited-before-public-disclosure-patch-window-is-not-a-safe-window","Zimbra Zero-Day Exploited Before Public Disclosure — Patch Window Is Not a Safe Window","2026-10-01T14:21:08.736+00:00",{"slug":25,"title":26,"published_at":27},"powershell-backdoor-taskstomp-exfiltrates-sensitive-data-via-phishing","PowerShell Backdoor TASK#STOMP Exfiltrates Sensitive Data via Phishing","2026-09-21T16:21:38.292+00:00",{"slug":29,"title":30,"published_at":31},"malicious-oauth-apps-bypass-passwords-to-breach-google-workspace","Malicious OAuth Apps Bypass Passwords to Breach Google Workspace","2026-09-14T14:22:03.944+00:00",{"slug":33,"title":34,"published_at":35},"mirage2fa-bypasses-mfa-by-hijacking-microsoft-365-session-cookies","Mirage2FA Bypasses MFA by Hijacking Microsoft 365 Session Cookies","2026-08-25T14:21:09.396+00:00",{"slug":37,"title":38,"published_at":39},"vmware-vcenter-exploited-for-persistent-access-within-days-of-patch-release","VMware vCenter Exploited for Persistent Access Within Days of Patch Release","2026-08-12T10:20:39.053+00:00",{"slug":41,"title":42,"published_at":43},"trojanized-quickfox-vpn-installer-delivers-state-sponsored-backdoor","Trojanized QuickFox VPN Installer Delivers State-Sponsored Backdoor","2026-08-05T08:21:16.411+00:00",{"slug":45,"title":46,"published_at":47},"phishing-as-a-service-exploits-ringcentral-branding-to-hijack-microsoft-365-accounts","Phishing-as-a-Service Exploits RingCentral Branding to Hijack Microsoft 365 Accounts","2026-08-04T22:20:20.526+00:00",{"slug":49,"title":50,"published_at":51},"critical-wordpress-wp2shell-flaws-actively-exploited-for-webshell-deployment","Critical WordPress 'wp2shell' Flaws Actively Exploited for Webshell Deployment","2026-07-21T18:20:55.11+00:00",{"slug":53,"title":54,"published_at":55},"clicklock-macos-malware-tricks-users-into-surrendering-login-passwords-via-social-engineering","ClickLock macOS Malware Tricks Users Into Surrendering Login Passwords via Social Engineering","2026-07-16T22:20:24.855+00:00",{"slug":57,"title":58,"published_at":59},"ai-powered-phishing-as-a-service-platform-targets-microsoft-365-accounts","AI-Powered Phishing-as-a-Service Platform Targets Microsoft 365 Accounts","2026-07-09T16:20:40.531+00:00",{"slug":61,"title":62,"published_at":63},"rokarolla-android-trojan-achieves-full-device-takeover-via-social-engineering","Rokarolla Android Trojan Achieves Full Device Takeover via Social Engineering","2026-06-16T18:20:36.678+00:00",{"slug":65,"title":66,"published_at":67},"mdr-alert-overload-creates-security-blind-spots","MDR Alert Overload Creates Security Blind Spots","2026-06-12T12:20:48.378+00:00",[69,74,79,84,88,92],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",8,{"slug":75,"name":76,"problem":77,"stories":78},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",5,{"slug":80,"name":81,"problem":82,"stories":83},"patch-management","Automated patch management","Known holes get closed in days, not months.",4,{"slug":85,"name":86,"problem":87,"stories":83},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":89,"name":90,"problem":91,"stories":83},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":93,"name":94,"problem":95,"stories":96},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",3,[98,103,108,112,118,122,126,130],{"family":99,"item":100,"code":101,"title":102,"together":73},"gdpr","32","Article 32","Security of processing",{"family":104,"item":105,"code":106,"title":106,"together":107},"itil","overview","ITIL",7,{"family":5,"item":109,"code":110,"title":111,"together":107},"si-3","SI-3","Malicious Code Protection",{"family":113,"item":114,"code":115,"title":116,"together":117},"cis","6","Control 6","Access Control Management",6,{"family":113,"item":119,"code":120,"title":121,"together":117},"14","Control 14","Security Awareness and Skills Training",{"family":113,"item":123,"code":124,"title":125,"together":117},"13","Control 13","Network Monitoring and Defense",{"family":113,"item":127,"code":128,"title":129,"together":78},"7","Control 7","Continuous Vulnerability Management",{"family":113,"item":131,"code":132,"title":133,"together":83},"2","Control 2","Inventory and Control of Software Assets"]