KSI-MLA-OSM—Operating SIEM Capability
Formerly KSI-MLA-01
>Control Description
>NIST 800-53 Controls
>Trust Center Components4
Ways to express your implementation of this indicator — approaches vary by organization size, complexity, and data sensitivity.
From the field: Mature implementations express monitoring coverage through MITRE ATT&CK heat maps — detection rule counts by tactic, alert-to-incident conversion rates, and MTTD/MTTR trends as dashboard indicators. Detection engineering is a continuous process with rules tested against the ATT&CK matrix, showing systematic coverage rather than ad-hoc alerting.
Threat Detection Dashboard
Dashboard expressing detection posture — threat detection metrics, alert volumes, MTTD/MTTR trends, and ATT&CK technique coverage
Security Monitoring Architecture
Architecture expressing SIEM/SOAR design — detection rules, alert routing, and escalation pipelines
Detection Engineering Process
How detection rules are created, tested, and tuned — aligned to MITRE ATT&CK with continuous coverage improvement
SOC Capabilities Overview
SOC capabilities, staffing model, and monitoring coverage
>Programmatic Queries
CLI Commands
splunk search 'index=_internal source=*metrics.log group=pipeline | stats sum(cpu_seconds) as cpu by name | sort -cpu' -earliest -1hsplunk search '| rest /servicesNS/-/-/saved/searches | search is_scheduled=1 alert_type!="" | table title eai:acl.app cron_schedule disabled'>20x Assessment Focus Areas
Aligned with FedRAMP 20x Phase Two assessment methodology
Completeness & Coverage:
- •Does your SIEM or centralized logging ingest events from all in-scope information resources — cloud infrastructure, applications, identity providers, network devices, and third-party services?
- •Are there log sources that are not yet integrated with centralized logging, and what is the plan and timeline to close those gaps?
- •Does centralized logging cover events, activities, and changes across all environments (production, staging, development, DR)?
- •How do you ensure log ingestion keeps pace with environment growth — new services, accounts, and regions are automatically onboarded?
Automation & Validation:
- •What tamper-resistance mechanisms protect centralized log data (immutable storage, write-once-read-many, cryptographic integrity verification)?
- •How do you detect if centralized log ingestion is disrupted — a source stops sending logs, or the SIEM pipeline drops events?
- •What automated monitoring alerts when log volume from a source drops unexpectedly, indicating potential logging failure or tampering?
- •How do you validate that log integrity controls actually prevent modification — do you test by attempting to alter or delete log entries?
Inventory & Integration:
- •What SIEM platform or log management system provides centralized logging, and what is its capacity and scalability?
- •How does the SIEM integrate with your asset inventory to validate that every in-scope resource has a corresponding log source?
- •What log shipping mechanisms (agents, API collectors, cloud-native log forwarding) feed into the centralized system?
- •How does your centralized logging integrate with alerting, incident response, and compliance reporting workflows?
Continuous Evidence & Schedules:
- •How do you demonstrate that centralized logging has been operational and complete for the past 90 days with no gaps?
- •Is log ingestion health data (source count, event volume, latency, error rates) available via API or dashboard?
- •What evidence shows log retention meets required durations and that retention policies are enforced automatically?
- •How do you prove that tamper-resistance controls have been active and effective throughout the assessment period?
Update History
Ask AI
Configure your API key to use AI features.