What it asks for. This Detect category, called Anomalies and Events in CSF 1.1, asks that anomalies, indicators of compromise and other potentially adverse events are analysed to characterise them and detect cybersecurity incidents. It covers correlating information from multiple sources, estimating impact and declaring incidents.
In practice. A monitoring function triages alerts using defined criteria, correlates events across sources in a SIEM or similar platform, enriches them with threat intelligence and decides when an event becomes an incident. Baselines of normal activity support anomaly detection. Evidence includes triage procedures, incident declaration criteria, alert handling metrics and case records.
Common gaps. Many organisations collect alerts but lack clear criteria for declaring an incident. Correlation across cloud, identity and endpoint data is often weak, and analysis depends on a few individuals.