What it asks for. The Detect function asks organisations to find and analyse possible cybersecurity attacks and compromises. It covers continuous monitoring of assets for anomalies and indicators of compromise, and analysis of adverse events to characterise them and decide whether an incident has occurred.
In practice. Doing this well means collecting logs from networks, endpoints, identity systems, cloud services and key applications into a central platform, with detection use cases mapped to relevant threats. Alerts are triaged by a staffed function, enriched with threat intelligence, and correlated across sources. Incidents are declared against defined criteria and handed to response. Evidence includes log source coverage, detection rule inventories, alert handling metrics, and records of tuning and testing.
Common gaps. Typical gaps include blind spots in cloud, SaaS and identity logs, untuned rules generating noise, and no testing of whether detections actually fire. Monitoring of external service providers and physical environments is often weak.