Insufficient monitoring coverage on customer networks
RSK-022
-
Last updated
Treating
Description
Not every customer network is connected to the monitoring platform yet, and some are watched only for availability. An attack on a network without log collection could go unnoticed for weeks.
Measures
The Monitoring Engineer connects customer sites by priority, starting with those that have the most users and the most exposed services. Each connected site sends its logs and alerts to the central collector.
- TSK-0276 by Sam de Vries