[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fde-ae":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","de-ae","DE.AE-2","Adverse Event Analysis",97,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This Detect category, called Anomalies and Events in CSF 1.1, asks that anomalies, indicators of compromise and other potentially adverse events are analysed to characterise them and detect cybersecurity incidents. It covers correlating information from multiple sources, estimating impact and declaring incidents.\n\n**In practice.** A monitoring function triages alerts using defined criteria, correlates events across sources in a SIEM or similar platform, enriches them with threat intelligence and decides when an event becomes an incident. Baselines of normal activity support anomaly detection. Evidence includes triage procedures, incident declaration criteria, alert handling metrics and case records.\n\n**Common gaps.** Many organisations collect alerts but lack clear criteria for declaring an incident. Correlation across cloud, identity and endpoint data is often weak, and analysis depends on a few individuals.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"akira-ransomware-reconstructed-from-forensic-crumbs-after-edr-gap","Akira Ransomware Reconstructed from Forensic Crumbs After EDR Gap","2026-10-08T12:21:27.762+00:00",{"slug":23,"title":24,"published_at":25},"poellm-botnet-exploits-exposed-ai-infrastructure-to-mine-crypto-on-3400-servers","PoeLLM Botnet Exploits Exposed AI Infrastructure to Mine Crypto on 3,400+ Servers","2026-10-07T18:21:48.858+00:00",{"slug":27,"title":28,"published_at":29},"shinyhunters-member-detained-cooperating-with-fbi-after-alleged-breach","ShinyHunters Member Detained, Cooperating with FBI After Alleged Breach","2026-10-03T20:20:20.063+00:00",{"slug":31,"title":32,"published_at":33},"ai-accelerated-attacks-outpace-fragmented-soc-defenses","AI-Accelerated Attacks Outpace Fragmented SOC Defenses","2026-09-25T14:21:36.552+00:00",{"slug":35,"title":36,"published_at":37},"ai-driven-malware-operates-autonomously-using-llms-for-command-control","AI-Driven Malware Operates Autonomously Using LLMs for Command & Control","2026-09-22T13:20:42.503+00:00",{"slug":39,"title":40,"published_at":41},"ddos-for-hire-service-nightmarestresser-seized-after-hundreds-of-thousands-of-attacks","DDoS-for-Hire Service NightmareStresser Seized After Hundreds of Thousands of Attacks","2026-09-17T17:21:55.715+00:00",{"slug":43,"title":44,"published_at":45},"china-linked-famoussparrow-targets-latin-american-governments-with-new-sparrowocky-backdoor","China-Linked FamousSparrow Targets Latin American Governments with New SparroWocky Backdoor","2026-09-17T17:20:25.364+00:00",{"slug":47,"title":48,"published_at":49},"ddos-for-hire-platform-with-566k-users-seized-by-fbi","DDoS-for-Hire Platform with 566K Users Seized by FBI","2026-09-17T12:20:22.951+00:00",{"slug":51,"title":52,"published_at":53},"cisa-guidance-deploy-cyber-decoys-to-detect-and-disrupt-adversaries","CISA Guidance: Deploy Cyber Decoys to Detect and Disrupt Adversaries","2026-09-16T18:22:19.71+00:00",{"slug":55,"title":56,"published_at":57},"healthcare-provider-exposes-280k-patient-records-in-june-2026-breach","Healthcare Provider Exposes 280K Patient Records in June 2026 Breach","2026-09-16T12:22:04.316+00:00",{"slug":59,"title":60,"published_at":61},"enterprise-ai-adoption-drowning-socs-in-alert-noise","Enterprise AI Adoption Drowning SOCs in Alert Noise","2026-09-12T12:20:59.11+00:00",{"slug":63,"title":64,"published_at":65},"ai-powered-swarm-attacks-reshape-the-cyber-kill-chain","AI-Powered Swarm Attacks Reshape the Cyber Kill Chain","2026-09-11T18:22:32.678+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",48,{"slug":73,"name":74,"problem":75,"stories":76},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",19,{"slug":78,"name":79,"problem":80,"stories":81},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",14,{"slug":83,"name":84,"problem":85,"stories":86},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",13,{"slug":88,"name":89,"problem":90,"stories":91},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",12,{"slug":93,"name":94,"problem":95,"stories":91},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[97,103,108,113,119,123,128,133],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","13","Control 13","Network Monitoring and Defense",49,{"family":98,"item":104,"code":105,"title":106,"together":107},"8","Control 8","Audit Log Management",38,{"family":5,"item":109,"code":110,"title":111,"together":112},"de-cm","DE.CM-1","Continuous Monitoring",32,{"family":114,"item":115,"code":116,"title":117,"together":118},"gdpr","32","Article 32","Security of processing",27,{"family":5,"item":120,"code":121,"title":122,"together":118},"pr-ds","PR.DS-1","Data Security",{"family":98,"item":124,"code":125,"title":126,"together":127},"3","Control 3","Data Protection",26,{"family":98,"item":129,"code":130,"title":131,"together":132},"6","Control 6","Access Control Management",22,{"family":98,"item":134,"code":135,"title":136,"together":137},"12","Control 12","Network Infrastructure Management",21]