The Detect function
The Detect function requires organizations to implement the processes and technologies necessary to identify a cybersecurity event in a timely manner. Its primary purpose is to ensure that anomalies, intrusions, or unauthorized activities are spotted quickly enough to trigger an effective response before significant damage occurs.
What it means
In practice, the Detect function serves as the "tripwire" of your security posture. While the Protect function aims to keep threats out, the Detect function assumes that protections may fail and focuses on visibility across the environment. It is about creating a continuous state of awareness regarding the health and security of your systems.
This involves establishing a baseline of "normal" operational behavior so that deviations—such as an unusual spike in data egress or a login from an unexpected geographic location—can be flagged as potential incidents. The scope covers network traffic, endpoint activity, user behavior, and system logs.
Implementation requires a combination of automated tools for real-time alerting and manual processes for periodic review. The goal is to minimize the "dwell time" (the period between an attacker entering a system and being discovered).
How to meet it
- Deploy a Security Information and Event Management (SIEM) or centralized logging solution to aggregate telemetry from across the network.
- Implement Endpoint Detection and Response (EDR) tools on all workstations and servers to monitor for malicious process execution.
- Configure automated alerts for high-risk events, such as multiple failed login attempts to administrative accounts or unauthorized changes to critical system files.
- Establish a network monitoring capability (such as IDS/IPS) to detect known attack patterns and anomalous traffic flows.
- Define operational baselines for your environment to enable the detection of anomalies that do not match a specific "known" threat signature.
- Integrate external threat intelligence feeds to automatically flag indicators of compromise (IoCs) associated with current global threats.
Evidence an auditor asks for
- Documentation describing the monitoring coverage, including a list of critical assets and logs being ingested into your detection tools.
- Screenshots or configuration exports of active alerting rules and thresholds within your SIEM or EDR platforms.
- Sample "detection-to-ticket" trails showing a logged alert that successfully triggered an incident response workflow.
- Records of periodic log reviews or reports generated by security monitoring tools to prove the system is being actively managed.
Common pitfalls
- Alert Fatigue: Configuring too many low-fidelity alerts, leading staff to ignore notifications or disable them entirely.
- Visibility Gaps: Failing to extend detection capabilities to cloud environments, remote endpoints, or third-party integrations (shadow IT).
- Lack of Baselining: Relying solely on signatures of known attacks without understanding "normal" behavior, which leaves the organization blind to zero-day exploits or insider threats.