🎯NIST Detect Function

A financial services firm observes its database server sending an unusually high volume of data at 3:00 AM, far exceeding normal baseline levels for that time. This anomalous activity triggers an internal alert.

A large retail company’s security team is receiving a series of minor security alerts from various systems. Which approach best ensures these related events are recognized as a potential attack?

An international bank receives threat intelligence reports containing new Indicators of Compromise (IoCs) – such as malicious IP addresses, domain names, and file hashes – associated with a cyber-attack campaign targeting financial institutions. The bank wants to leverage this information to strengthen its security monitoring. According to the NIST CSF “Detect” function, how should the bank use these IoCs?

A tech company suspects that after an employee fell for a phishing email, an attacker has obtained the employee’s credentials and is now attempting lateral movement within the corporate network. The attacker is using the stolen login to try accessing several internal servers that the employee account would not normally use, in an effort to expand their foothold. Which control aligned with the NIST CSF “Detect” function would best help the company identify this lateral movement activity quickly?

An insurance firm experienced a prolonged malware infection unnoticed for weeks. Which measure best helps identify malware infections promptly in the future?

A mid-sized manufacturing company wants to shift from reactive to proactive security monitoring. What’s the most appropriate step?

During an IT audit of a retail company, auditors discover that the organization has deployed several security monitoring tools (an intrusion detection system, a SIEM, etc.), but no formal process or personnel are assigned to review the alerts consistently or to respond to potential security events. In practice, alerts are sometimes ignored or handled ad hoc by whoever notices them. Which aspect of the NIST CSF “Detect” function is lacking at this company, and what improvement is needed?

A financial technology startup has set up basic security monitoring: they collect logs in a SIEM and have one analyst responsible for watching alerts. However, the team has never tested whether their detection setup truly works against real threats. The CISO is concerned that the team might not recognize or properly handle a sophisticated attack, since they’ve only dealt with benign alerts so far. What practice related to the NIST CSF “Detect” function should the company implement to gain confidence that its detection capabilities work as intended?

A multinational corporation is expanding its security monitoring capabilities by logging more user activities and network traffic across all its regional offices. However, the Chief Privacy Officer warns that in some countries, data privacy laws restrict how user data can be monitored or stored. When enhancing detection capabilities in line with the NIST CSF “Detect” function, what must the corporation ensure?

A logistics company suffered a cyber incident where an attacker managed to breach a system undetected. The security team eventually discovered the attack when an employee noticed files being transferred abnormally, not because of an automated alert. Upon investigation, they found that the attacker’s activities did not trigger the existing detection rules, exposing a gap in their monitoring setup. After containing the incident, management wants to improve the company’s detection capabilities. What should the company do, in alignment with the NIST CSF “Detect” function, to learn from this incident and strengthen its future detection?