16 – Information Security Incident Management
Select > > > > > Reports or Dashboards >
Control 16: Information security incident management of the ISO 27002 standard expects your enterprise to effectively and consistently manage information security incidents.
To assess your enterprise's compliance with this requirement, use the following reports:
| Dashboards | Reports |
|---|---|
|
Internal Reconnaissance by Event |
|
Reports the number of confidentiality breach events by IP addresses of the source system. The table provides results by the IP address, name, and zone of the source; the number of events; and when the most recent event occurred.
Reports the number of denial of service (DoS) events by IP addresses of the targeted system. The table provides results by the IP address , name, and zone of the targeted system; the type of DoS activity; and the number of events.
Reports changes to files where the modification might compromise the integrity of the file. The table provides results by the path to the modified file, the IP address and name of the targeted host, the number of modifications, and when the most recent event occurred.
Reports the number of changes to monitored files by target IP address and type of change. The report includes only events where agent severity is or . The table provides results by the type of event; the IP address, name, and zone of the targeted system; and the number of events.
Reports the number of attacks associated with integrity breaches, by source IP and type of breach. The table provides results by the type of breach event; the IP address, name, and zone of the source system; the number of events; and when the most recent event occurred.
Provides an overview of events that indicate internal reconnaissance, which are attacks that occur within your organization's network, systems, and premises.
Internal Reconnaissance by Event
Reports the top events by the source IP address associated with the specified internal reconnaissance events. The table provides results by the type of event, the IP address, name, and zone of the target and source hosts; and the number of events.
You must specify at least one event by type.
Internal Reconnaissance by Source Address
Reports the number of internal reconnaissance events associated with the specified source IP address. The table provides results by the type of event, the IP address, name, and zone of the target and source hosts; and the number of events.
You must specify at least one IP address.
Internal Reconnaissance by Target Address
Reports the number of internal reconnaissance events associated with the specified target IP address. The table provides results by the type of event, the IP address, name, and zone of the target and source hosts; and the number of events.
You must specify at least one IP address.