Threat Detection
What is Threat Detection?
The process and technology used to identify malicious activity, policy violations, and other security threats within an organization's environment.
Terms that appear alongside threat detection
Each of these is named in at least one of the same controls as threat detection. The number is how many controls name both.
- insider threat 6 shared controls
- threat intelligence 5 shared controls
- incident response 4 shared controls
- cybersecurity 4 shared controls
- integrity 4 shared controls
- compliance 4 shared controls
- phishing 3 shared controls
- security monitoring 3 shared controls
Frameworks that govern threat detection
What the standards actually require on threat detection
Requirements naming threat detection across 6 standards, quoted from the control text.
Define and implement a logging, threat detection and incident response strategy so threats are detected and remediated rapidly and compliance requirements for logging are met.
ASBv3-GS-7 · Define and implement logging, threat detection and incident response strategy →Deploy runtime threat detection that monitors process activity, file changes, and network behavior inside containers. Tune detections to the workload baseline and integrate alerts with the SOC.
SP800-190-3.17 · Runtime Threat Detection →The entity must document and implement an ICT-related incident policy that documents the incident management process of DORA Article 17;
dora-rts-on-ict-risk-management-framework-commission-delegated-regulation-eu-2024-1774::22 · Article 22: ICT-related incident management policy →Article 32 establishes the ADVANCED CYBERSECURITY CONTROLS that critical-impact entities must implement IN ADDITION TO the Article 30 minimum controls.
NCCS-Art.32_33_34 · Advanced cybersecurity controls (NCCS Articles 32-34) - for critical-impact entities →HKMA TM-G-1 Cyber + Audit + Outsourcing + Cloud. (1) SECURITY MONITORING AND SIEM (TM-G-1.7.1) - SIEM + SOC + 24x7 monitoring + log management + correlation + use cases + alert handling + escalation + UEBA + behavior analytics + SOAR automation + threat detect...
HKMA-TMG1-Cyber-Monitoring-Threat-Intel-IR-Audit-Outsource-Cloud · TM-G-1 Security Monitoring + SIEM + Threat Intel + Cyber IR + Audit + Outsourcing + Cloud Computing Risk →HL7 FHIR Audit + Provenance + Digital Signatures. AUDITEVENT LOGGING (FHIR-SEC-07 + FHIR-SEC-4.1) - FHIR AuditEvent Resource for structured audit logging + IETF RFC 3881 + IHE ATNA + DICOM Audit + comprehensive audit trail of: (a) authentication events;
HL7-FHIR-Audit-Provenance-DigitalSignatures-Integrity · HL7 FHIR Audit + Provenance + Digital Signatures + AuditEvent Resource + Audit Log Integrity + Retention →Questions people ask about threat detection
What is Threat Detection?
Why is Threat Detection important for compliance?
Which compliance frameworks address Threat Detection?
Where can I learn more about Threat Detection?
See how Threat Detection applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.