Skip to main content
Skip table of contents

NCSC - Investigations

Name

Description

Investigation ID

NCSC Control Support

Data Source

Classifications

Log Sources

CCF: Account Modification InvThis investigation provides details around account modifications across the environment.709B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Platform Manager(s)AuditAll Available Log Sources
CCF: Applications Accessed By User InvThis investigation provides information about user-accessed applications.689B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Data Processor(s)AuditAll Available Log Sources
CCF: Audit Log InvThis investigation provides details around potential control failures around auditing systems.  This requires the configuration and enablement of the CCF: Audit Logging Stopped Alarm, CCF: Audit Log Cleared Alarm, and CCF: Failed Audit Log Write Alarms.701 B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Platform Manager(s)AuditAll Available Log Sources
CCF: Backup Activity InvThis investigation provides details around activity from backup events.688B4.a.04, B5.c.01, B5.c.03, D1.b.04Data Processor(s)OperationsAll Available Log Sources
CCF: Compromises Detected InvThis investigation provides a summary of detected compromises of security by Entity and Impacted Host.690 B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03LogMart(s)SecurityAll Available Log Sources
CCF: Config/Policy Change InvThis investigation provides a summary of the occurrence of configuration or policy changes across critical and production environments (entity structure).675B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, B4.d.02, C1.d.03Data Processor(s)AuditAll Available Log Sources
CCF: Critical Environment Error InvThis investigation provides summary details around critical or error messages received from critical servers or systems (entity structure) to support change management procedures.676 B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Platform Manager(s)OperationsAll Available Log Sources
CCF: Deleted Account InvThis investigation provides detailed information when any new accounts are deleted across any logged environments (entity structure).706B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Platform Manager(s)AuditAll Available Log Sources
CCF: Denial of Service InvThis investigation provides details of detected denial of service attempts.707 B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, B4.d.02, C1.d.03Data Processor(s)SecurityAll Available Log Sources
CCF: Disabled Account InvThis investigation provides detailed information when any new accounts are revoked (disabled) across any logged environments (entity structure).705B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Platform Manager(s)AuditAll Available Log Sources
CCF: Enabled Account InvThis investigation provides detailed information when any new accounts are granted (enabled) across any logged environments (entity structure).704B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Platform Manager(s)AuditAll Available Log Sources
CCF: Excessive Authentication Failure InvThis investigation provides detailed information around excessive user account authentication failures  (>10 authentication failures in 30 minutes) across any logged environments (entity structure).708B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Platform Manager(s)SecurityAll Available Log Sources
CCF: GeoIP InvThis report summarizes GeoIP activity that is associated with AI Engine GeoIP rules, in the CCF compliance automation suite.696 B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, B4.d.02, C1.d.03Platform Manager(s)SecurityAll Available Log Sources
CCF: Host Access Granted And Revoked InvThis investigation details all access granted and revoked for production systems.691B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Data Processor(s)AuditAll Available Log Sources
CCF: LogRhythm Data Loss Defender Log InvThis investigation provides information on data generated by the LogRhythm Data Loss Defender.  Data is grouped by Entity, Impacted Host, Common Event, and Object with a count of how many times that condition has been experienced within the investigation period.692B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04Data Processor(s)AuditAll Available Log Sources
CCF: Malware Detected InvThis investigation provides a summary of malware activity by entity and impacted host within the organization's critical and production environments (entity structure).677B4.c.03Platform Manager(s)SecurityAll Available Log Sources
CCF: Object Access InvThis investigation summarizes object access by Impacted Host.693B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04Data Processor(s)AuditAll Available Log Sources
CCF: Password Modification InvThis investigation provides detail around password modification to accounts within the environment.702 B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Platform Manager(s)AuditAll Available Log Sources
CCF: Patch Activity InvThis investigation provides a summary of applied patches grouped by Origin Host. It can demonstrate that all system components have the latest security patches installed.678B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, B4.d.02, C1.d.03Data Processor(s)SecurityAll Available Log Sources
CCF: Physical Access InvThis investigation summarizes physical door access/authentication success and failures within the organization's physical security perimeter.679B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Platform Manager(s)AuditAll Available Log Sources
CCF: Privileged Account Escalation InvThis investigation provides detail around privileged access escalation within a Linux and Windows OS. This requires configuration and enablement of CCF: Windows RunAs Privilege Escalation and CCF: Linux sudo Privilege Escalation AIE rules.700B2.a.01, B2.a.02, B2.c.01, B2.c.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Platform Manager(s)SecurityAll Available Log Sources
CCF: Privileged Account Modification InvThis investigation provides details around modifications made to privileged accounts within the environment.  This investigation requires the CCF: Privileged Accounts (user list) to be established and updated periodically.703B2.a.01, B2.a.02, B2.c.01, B2.c.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Data Processor(s)AuditAll Available Log Sources
CCF: Rogue Access Point InvThis investigation provides a summary of all detected rogue wireless access points by Impacted Host across critical, production, and online banking environments (entity structure).680 B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, B4.d.02, C1.d.03Platform Manager(s)SecurityAll Available Log Sources
CCF: Signature Activity InvThis investigation provides summary information on signature update activity across critical and production environments (entity structure).681B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, B4.d.02, C1.d.03LogMart(s)OperationsAll Available Log Sources
CCF: Suspected Wireless Attack InvThis investigation provides information on suspected wireless attacks at the internal boundary, including the type of attack and impacted (targeted) host and application (if applicable).  This is based on Critical and Production environments (can be defined with entity structure).682 B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, B4.d.02, C1.d.03Platform Manager(s)SecurityAll Available Log Sources
CCF: Suspicious Users InvThis investigation lists all users generating suspicious activity ordered by the number of events detected, from highest to lowest.685B2.a.01, B2.a.02, B2.c.01, B2.c.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Data Processor(s)SecurityAll Available Log Sources
CCF: Time Sync Error InvThis investigation provides a summary of time sync errors occurring within critical and production environments (can be defined with entity structure).683 B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, B4.d.02, C1.d.03Platform Manager(s)AuditAll Available Log Sources
CCF: Unknown User Account InvThis investigation provides detail of activity from unknown user accounts, based off of CCF user lists.697B2.a.01, B2.a.02, B2.c.01, B2.c.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Data Processor(s)SecurityAll Available Log Sources
CCF: Use Of Non-Encrypted Protocols InvThis investigation lists any use of non-encrypted protocols.686B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04LogMart(s)AuditAll Available Log Sources
CCF: User Misuse InvThis investigation summarizes detected misuse by user.687B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04Platform Manager(s)SecurityAll Available Log Sources
CCF: User Object Access InvThis investigation summarizes successful object access activity by user.694B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03Data Processor(s)AuditAll Available Log Sources
CCF: Vulnerability Detected InvThis investigation provides a summary of potential vulnerabilities detected across the critical and production environments (can be defined with entity structure).684B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, B4.d.02, C1.d.03Platform Manager(s)SecurityAll Available Log Sources

*NCSC Control Key

Control Format

Definition

xx.x.xxObjective & Principal, Sub-Objective, Indicators of Good Practice (IGP)
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.