adverse-event-analysis-de-ae-adverse-event-analysis

name	Adverse Event Analysis (DE.AE)_adverse-event-analysis
description	Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents
category	information-gathering
version	2.0
author	cyberstrike-official
tags	["nist","csf","v2.0","adverse event analysis (de-ae)","de","category"]
tech_stack	["aws","azure","gcp","siem"]
cwe_ids	["CWE-778"]
chains_with	[]
prerequisites	[]
severity_boost	{}

Adverse Event Analysis (DE.AE) Adverse Event Analysis

High-Level Description

Function: DETECT (DE) Framework: NIST Cybersecurity Framework v2.0

Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents

What to Check

• Verify Adverse Event Analysis (DE.AE) Adverse Event Analysis outcome is achieved
• Review documentation and evidence for Adverse Event Analysis (DE.AE)
• Assess organizational maturity for DETECT function

How to Test

Step 1: Identify Current Profile

Determine the organization's current and target CSF profile tier for Adverse Event Analysis (DE.AE).

Step 2: Assess Outcome Achievement

# Review organizational policies and procedures
# Check for evidence that Adverse Event Analysis (DE.AE) outcome is met
# Interview stakeholders responsible for DETECT

Step 3: Map to Technical Controls

Identify which SP 800-53 controls implement this CSF outcome and verify their operating effectiveness.

Tools

Tool	Purpose	Usage
cloud-audit-mcp	Assess cloud security posture	cloud_audit_* tools
Manual Review	Policy and procedure review	Interviews and documentation

Remediation Guide

Achieve the Adverse Event Analysis (DE.AE) Adverse Event Analysis outcome:

Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents

Risk Assessment

Finding	Severity	Impact
Adverse Event Analysis (DE.AE) Adverse Event Analysis outcome not achieved	High	DETECT Function Gap

CWE Categories

CWE ID	Title
CWE-778	Insufficient Logging

References