CSF Building a Metrics Program – Detect Part 4 of 6

Detect directly influenced a program that I helped stand up when I was given a SOC to lead. Honestly, I really enjoyed it. It inspired me to write about it. Since you’re on part 4 of 6, I assume you’ve read about Govern, Identify, and Protect and are following on to see how deep this rabbit hole can go.

The whole goal about Detect is to find out if we know when something important is happening, and would we know quickly enough to do something about it.

Using NIST CSF 2.0, Detect has two categories:

• DE.CM — Continuous Monitoring
• DE.AE — Adverse Event Analysis

Detect’s Continuous Monitoring answers if we have enough visibility across our environments to detect meaningful changes, threats, and security events before they impact business negavitely.

Control / Outcome	Leading indicators	Lagging indicators
DE.CM-01 Networks and network services are monitored	% critical network infrastructure monitored; network telemetry coverage; monitoring availability	Network-based attacks discovered through external notification; attacks occurring outside monitoring visibility
DE.CM-02 Physical environment is monitored	% critical facilities covered by appropriate monitoring; monitoring availability	Physical security events discovered after the fact; incidents involving monitoring gaps
DE.CM-03 Personnel activity and technology usage are monitored	% critical user activity covered by monitoring; privileged activity monitoring coverage	Malicious or inappropriate activity discovered after the fact
DE.CM-04 Technology is monitored for cybersecurity events	% critical assets sending security telemetry; EDR coverage; endpoint monitoring coverage	Compromised assets without telemetry; attacks discovered through non-security sources
DE.CM-05 External service providers are monitored	% critical suppliers/services with security monitoring or notification mechanisms; supplier telemetry coverage	Supplier incidents discovered through external sources; supplier events not communicated within SLA
DE.CM-06 Physical and logical access are monitored	% privileged access monitored; authentication event coverage; anomalous access detection coverage	Unauthorized access discovered after the fact; compromised credentials
DE.CM-07 Monitoring is continuously maintained	% monitoring sources operating correctly; telemetry health; detection coverage validation frequency	Detection gaps caused by failed telemetry; monitoring outages during security events
DE.CM-08 Vulnerability scanning is performed	Critical asset scanning coverage; authenticated scan coverage; scan frequency	Exploited vulnerabilities that were not detected through vulnerability monitoring

Find out what % of our critical assets and business services are generating the telemetry (useful enough logging data) necessary to detect defined threat scenarios.

Detect’s Adverse Event Analysis distinguishes the difference between normal activity and something that needs special attention and investigation.

Control / Outcome	Leading indicators	Lagging indicators
DE.AE-01 Potentially adverse events are analyzed to understand associated activities	% high-risk alerts triaged within SLA; alert investigation coverage; analyst investigation quality	Missed malicious activity; incidents initially classified as benign
DE.AE-02 Adverse events are analyzed to understand their potential impact	% material alerts evaluated for business impact; critical asset context available to analysts	Incidents where business impact was discovered late
DE.AE-03 Event data is correlated from multiple sources	% critical threat scenarios covered by multi-source correlation; correlation rule coverage	Attacks missed because individual events were not correlated
DE.AE-04 Estimated impact and scope of adverse events are determined	% significant events with scope/impact assessment within target time; asset/business context availability	Material scope discovered late; underestimated incident impact
DE.AE-05 Adverse events are aggregated and correlated according to risk	% high-risk events automatically correlated/prioritized; risk-based alert coverage	High-risk activity buried in alert volume; missed attack chains
DE.AE-06 Information about adverse events is provided to authorized personnel	% material events escalated within SLA; escalation accuracy	Delayed escalation; executives/business owners notified late
DE.AE-07 Cybersecurity event information is integrated into incident response	% qualified events transferred to IR with complete context; handoff SLA adherence	Delayed containment caused by incomplete detection information
DE.AE-08 Incident classification is performed according to established criteria	% incidents classified according to defined criteria; classification QA rate	Misclassified incidents; incidents requiring reclassification after impact

We can get a lot of data looking at SLAs and MTTD, but you really have to get a micro view of it. If you detect an anomalous event, look into when the event occurred to the time the alert went out. Do use-cases run every hour? Every half-hour? Every 5 minutes? What is right? Depends on the specific use-case and the assets involved and which business function they serve. Remember that detection is like a smoke alarm alerting you there might be a something on fire and the quicker you can check it out is the difference between turning the stove off and rebuilding a house.

Here’s some metrics that really need to be on an executive dashboard.

Metric	Executive question
1. Critical Asset Detection Coverage	Can we see what’s important?
2. Critical Threat Scenario Coverage	Can we detect the threats that matter?
3. Material Threat Detection Time	How quickly do we recognize important attacks?
4. Detection Effectiveness	How often do our detections identify real malicious activity?
5. False Positive Rate	How much analyst capacity is being consumed by noise?
6. High-Risk Alert SLA	Are important signals being analyzed quickly enough?
7. Threat Correlation Coverage	Can we connect seemingly unrelated events into an attack?
8. Incident Escalation Timeliness	Are material events getting to the right people quickly?
9. Detection Gap Rate	How many defined threat scenarios currently lack adequate detection?
10. Detection Validation Rate	Are we regularly proving that our detections actually work?