Skip to main content
Skip table of contents

NIST – Investigations

The Intelligent Indexing settings are recommendations. The default configuration is No.

Investigation Name

Investigation Description

Augmented RequirementsData SourceIntelligent IndexingClassificationsLog Sources

Investigation ID

CCF: Applications Accessed By User Inv

This investigation provides information about user accessed applications.

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.16, 3.13.2, 3.13.4, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.8.9, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-2, AC-20, AC-23, AC-24, AC-25, AC-3, AC-6, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-6, CP-7, CP-9, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-3, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-4, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-4, PS-5, PS-7, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SA-4, SA-5, SA-9, SC-16, SC-2, SC-28, SC-3, SC-36, SC-38, SC-4, SC-7, SI-2, SI-3, SI-4, SI-5, SI-6, SI-7Data Processor(s)NoAuditAll Available Log Sources

689

CCF: Audit Log Inv

This investigation provides details around potential control failures around auditing systems. This requires the configuration and enablement of the CCF: Audit Logging Stopped Alarm, CCF: Audit Log Cleared Alarm, CCF: Failed Audit Log Write Alarms.

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.21, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.10.1, 3.10.2, 3.10.3, 3.10.4, 3.10.5, 3.13.1, 3.13.15, 3.13.16, 3.13.2, 3.13.4, 3.13.8, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.3.8, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.1, 3.5.10, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.7.6, 3.8.1, 3.8.2, 3.8.5, 3.8.7, 3.8.8, 3.8.9, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-2, AC-20, AC-21, AC-23, AC-24, AC-25, AC-3, AC-4, AC-6, AC-7, AU-10, AU-11, AU-12, AU-13, AU-14, AU-15, AU-3, AU-4, AU-5, AU-6, AU-7, AU-8, AU-9, CA-2, CA-7, CM-11, CM-12, CM-3, CM-5, CM-6, CM-7, CM-8, CP-13, CP-6, CP-7, CP-9, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-2, DE.CM-3, DE.CM-4, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-3, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-2, MA-3, MA-4, MA-5, MA-6, MP-2, MP-4, MP-6, MP-7, MP-8, PA-3, PA-4, PE-17, PE-2, PE-3, PE-4, PE-5, PE-6, PE-7, PE-8, PL-4, PL-8, PL-9, PM-12, PM-14, PM-17, PM-23, PM-26, PM-6, PR.AC-1, PR.AC-2, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-3, PR.DS-4, PR.DS-5, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-4, PR.IP-6, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-4, PS-5, PS-7, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-10, SA-18, SA-19, SA-3, SA-4, SA-5, SA-9, SC-13, SC-16, SC-18, SC-2, SC-24, SC-27, SC-28, SC-3, SC-31, SC-36, SC-38, SC-4, SC-40, SC-5, SC-7, SC-8, SI-11, SI-12, SI-14, SI-16, SI-17, SI-18, SI-19, SI-2, SI-20, SI-3, SI-4, SI-5, SI-6, SI-7, SI-8Platform Manager(s)YesAuditAll Available Log Sources

701

CCF: Backup Activity Inv

This investigation provides detail around activity from backup events.

Augment: 3.1.10, 3.1.12, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.16, 3.13.2, 3.14.1, 3.14.2, 3.14.3, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.8, 3.6.1, 3.6.2, 3.6.3, 3.8.9, AC-16, AC-20, AC-21, AC-23, AU-10, AU-11, AU-12, AU-14, AU-15, AU-3, AU-4, AU-5, AU-6, AU-7, AU-9, CA-2, CA-7, CP-13, CP-6, CP-7, CP-9, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, DE.DP-2, DE.DP-5, ID.AM-5, ID.RA-3, ID.SC-4, IR-10, IR-4, IR-6, IR-7, IR-9, PL-8, PL-9, PM-12, PM-17, PM-23, PM-26, PM-6, PR.DS-1, PR.DS-2, PR.DS-4, PR.IP-4, PR.IP-9, PR.PT-1, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SC-18, SC-2, SC-24, SC-27, SC-28, SC-31, SC-36, SC-38, SC-4, SC-7, SI-11, SI-17, SI-3, SI-4, SI-5, SI-7, SI-8Data Processor(s)YesOperationsAll Available Log Sources

688

CCF: Compromises Detected Inv

This investigation provides a summary of detected compromises of security by Entity and Impacted Host.

Augment: 3.1.12, 3.1.3, 3.13.1, 3.13.15, 3.13.2, 3.14.1, 3.14.2, 3.14.3, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.6.1, 3.6.2, 3.6.3, AC-16, AC-20, AC-23, AC-4, AU-10, AU-12, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-4, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-5, PR.DS-5, PR.IP-9, PR.PT-1, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SA-9, SC-18, SC-2, SC-24, SC-27, SC-31, SC-36, SC-38, SC-4, SC-40, SC-7, SI-14, SI-2, SI-3, SI-4, SI-5, SI-7, SI-8LogMart(s)YesSecurityAll Available Log Sources

690

CCF: Config/Policy Change Inv

This investigation provides a summary of the occurrence of configuration or policy changes across critical and production environments (entity structure).

Augment: 3.1.10, 3.1.12, 3.1.13, 3.1.2, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.8, 3.4.2, 3.4.3, 3.4.6, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.8.7, 3.8.8, 3.8.9, AC-16, AC-18, AC-20, AC-23, AC-4, AU-10, AU-11, AU-12, AU-14, AU-15, AU-3, AU-5, AU-6, AU-7, AU-9, CA-2, CA-7, CM-11, CM-12, CM-3, CM-5, CM-6, CM-7, CM-8, CP-13, CP-6, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-2, IA-3, IA-4, IA-5, IA-7, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IR-10, IR-4, IR-6, IR-7, IR-9, MA-2, MA-3, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-5, PR.AC-7, PR.DS-3, PR.DS-5, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-10, SA-18, SA-19, SA-3, SA-4, SA-5, SA-9, SC-13, SC-16, SC-2, SC-36, SC-38, SC-4, SC-7, SI-16, SI-17, SI-2, SI-3, SI-4, SI-5, SI-7Data Processor(s)YesAuditAll Available Log Sources

675

CCF: Critical Environment Error Inv

This investigation provides summary details around critical or error messages received from critical servers or systems (entity structure) to support change management procedures.

Augment: 3.1.12, 3.1.3, 3.13.1, 3.13.15, 3.13.16, 3.13.2, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.4.2, 3.4.3, 3.4.6, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.9, AC-16, AC-18, AC-20, AC-23, AU-10, AU-11, AU-12, AU-14, AU-15, AU-3, AU-4, AU-5, AU-6, AU-7, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-6, CP-7, CP-9, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IR-10, IR-4, IR-6, IR-7, IR-9, MA-2, MA-3, MA-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.DS-4, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-4, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-3, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-10, SA-18, SA-19, SA-3, SA-5, SA-9, SC-16, SC-18, SC-2, SC-24, SC-27, SC-31, SC-36, SC-38, SC-4, SC-7, SI-11, SI-17, SI-2, SI-3, SI-4, SI-5, SI-7Platform Manager(s)YesOperationsAll Available Log Sources

676

CCF: GeoIP Inv

This report summarizes GeoIP activity that is associated with AI Engine GeoIP rules, in the CCF compliance automation suite.

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.13.4, 3.13.8, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-2, AC-20, AC-21, AC-23, AC-24, AC-25, AC-3, AC-4, AC-6, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SA-4, SA-5, SA-9, SC-18, SC-2, SC-24, SC-27, SC-28, SC-3, SC-31, SC-36, SC-38, SC-4, SC-40, SC-7, SC-8, SI-3, SI-4, SI-5, SI-6, SI-7, SI-8Platform Manager(s)YesSecurityAll Available Log Sources

696

CCF: Host Access Granted And Revoked Inv

This investigation details all access granted and revoked for production systems.

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.13.4, 3.13.8, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-2, AC-20, AC-21, AC-23, AC-24, AC-25, AC-3, AC-4, AC-6, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-4, PS-5, PS-7, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-10, SA-18, SA-19, SA-4, SA-5, SA-9, SC-18, SC-2, SC-24, SC-27, SC-28, SC-3, SC-31, SC-36, SC-38, SC-4, SC-40, SC-7, SC-8, SI-14, SI-3, SI-4, SI-5, SI-6, SI-7, SI-8Data Processor(s)YesAuditAll Available Log Sources

691

CCF: LogRhythm Data Loss Defender Log Inv

This investigation provides information on data generated by the LogRhythm Data Loss Defender. Data is grouped by Entity, Impacted Host, Common Event, and Object with a count of how many times that condition has been experienced within the investigation period.

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.21, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.16, 3.13.2, 3.13.4, 3.13.8, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.8, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.8.7, 3.8.8, 3.8.9, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-20, AC-21, AC-23, AC-24, AC-25, AC-3, AC-4, AC-6, AU-10, AU-11, AU-12, AU-13, AU-14, AU-15, AU-3, AU-5, AU-6, AU-7, AU-9, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-6, CP-7, CP-9, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-3, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-2, MA-3, MA-4, MA-5, MA-6, MP-2, MP-4, MP-6, MP-7, MP-8, PA-3, PA-4, PE-17, PL-8, PL-9, PM-12, PM-17, PM-23, PM-26, PM-6, PR.AC-3, PR.AC-5, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-4, PR.IP-6, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-7, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-10, SA-18, SA-19, SA-4, SA-5, SA-9, SC-13, SC-16, SC-18, SC-2, SC-24, SC-27, SC-28, SC-31, SC-36, SC-38, SC-4, SC-7, SI-12, SI-16, SI-18, SI-19, SI-2, SI-20, SI-3, SI-4, SI-5, SI-7Data Processor(s)YesAuditAll Available Log Sources

692

CCF: Malware Detected Inv

This investigation provides a summary of malware activity by entity and impacted host within the organization's critical and production environments (entity structure).

Augment: 3.1.12, 3.1.3, 3.13.1, 3.13.15, 3.13.2, 3.14.1, 3.14.2, 3.14.3, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.6.1, 3.6.2, 3.6.3, AC-16, AC-20, AC-23, AC-4, AU-12, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-4, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-5, PR.DS-5, PR.IP-9, PR.PT-1, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SA-9, SC-18, SC-2, SC-24, SC-27, SC-31, SC-36, SC-38, SC-4, SC-40, SC-7, SI-14, SI-3, SI-4, SI-5, SI-7, SI-8Platform Manager(s)YesSecurityAll Available Log Sources

677

CCF: Object Access Inv

This investigation summarizes object access by Impacted Host.
 

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.21, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.13.4, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.8, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.8.7, 3.8.8, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-2, AC-20, AC-21, AC-23, AC-24, AC-25, AC-3, AC-4, AC-6, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, AU-9, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-7, CP-9, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-3, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-2, MA-3, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-23, PM-26, PM-6, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-4, PR.IP-6, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-4, PS-5, PS-7, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-10, SA-18, SA-19, SA-4, SA-5, SA-9, SC-2, SC-28, SC-3, SC-36, SC-38, SC-4, SC-7, SI-12, SI-16, SI-18, SI-19, SI-20, SI-3, SI-4, SI-5, SI-6, SI-7Data Processor(s)NoAuditAll Available Log Sources

693

CCF: Password Modification Inv

This investigation provides detail around password modification to accounts within the environment.

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.13.4, 3.13.8, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.9.2, AC-10, AC-16, AC-18, AC-2, AC-20, AC-21, AC-23, AC-3, AC-4, AC-6, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-3, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-4, PS-5, PS-7, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-10, SA-18, SA-19, SA-4, SA-5, SA-9, SC-18, SC-2, SC-27, SC-28, SC-3, SC-31, SC-36, SC-38, SC-4, SC-7, SC-8, SI-3, SI-4, SI-5, SI-6, SI-7, SI-8Platform Manager(s)NoAuditAll Available Log Sources

702

CCF: Patch Activity Inv

This investigation provides a summary of applied patches grouped by Origin Host. It can demonstrate that all system components have the latest security patches installed.

Augment: 3.1.10, 3.1.12, 3.1.2, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.4.2, 3.4.3, 3.4.6, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, AC-16, AC-20, AC-23, AC-4, AU-12, AU-14, AU-15, AU-3, AU-5, AU-6, AU-7, CA-2, CA-7, CM-11, CM-12, CM-3, CM-5, CM-6, CM-7, CM-8, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-2, IA-3, IA-4, IA-5, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IR-10, IR-4, IR-6, IR-7, IR-9, MA-2, MA-3, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-5, PR.AC-7, PR.DS-3, PR.DS-5, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-10, SA-18, SA-19, SA-3, SA-4, SA-5, SA-9, SC-16, SC-18, SC-2, SC-24, SC-27, SC-31, SC-36, SC-38, SC-4, SC-7, SI-11, SI-17, SI-2, SI-3, SI-4, SI-5, SI-7Data Processor(s)YesSecurityAll Available Log Sources

678

CCF: Physical Access Inv

This investigation summarizes physical door access/authentication success and failures within the organization's physical security perimeter.

Augment: 3.1.1, 3.1.10, 3.1.2, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.10.1, 3.10.2, 3.10.3, 3.10.4, 3.10.5, 3.13.1, 3.13.15, 3.13.2, 3.14.1, 3.14.2, 3.14.3, 3.14.7, 3.3.6, 3.3.8, 3.3.9, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.6, 3.8.1, 3.8.2, 3.8.5, 3.8.7, 3.8.8, 3.8.9, 3.9.2, AC-10, AC-2, AC-24, AC-25, AC-3, AC-6, AU-11, AU-12, AU-14, AU-6, AU-7, AU-9, CA-2, CA-7, CP-6, CP-7, CP-9, DE.AE-2, DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-2, DE.CM-6, DE.CM-7, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.SC-3, ID.SC-4, IP-2, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-4, PE-17, PE-2, PE-3, PE-4, PE-5, PE-6, PE-7, PE-8, PL-8, PM-6, PR.AC-1, PR.AC-2, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.IP-4, PR.IP-9, PR.PT-1, PR.PT-2, PS-4, PS-5, PS-7, PS-8, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SA-4, SA-9, SC-2, SC-28, SC-3, SC-36, SC-38, SC-4, SC-7, SI-6, SI-7Platform Manager(s)YesAuditAll Available Log Sources

679

CCF: Privileged Account Escalation Inv

This investigation provides detail around privileged access escalation within a Linux and Windows OS. This requires configuration and enablement of CCF: Windows RunAs Privilege Escalation & CCF: Linux sudo Privilege Escalation AIE rules.

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.16, 3.13.2, 3.13.4, 3.13.8, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-2, AC-20, AC-21, AC-23, AC-24, AC-25, AC-3, AC-6, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-2, MA-3, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-4, PS-5, PS-7, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-10, SA-18, SA-19, SA-4, SA-5, SA-9, SC-18, SC-2, SC-28, SC-3, SC-36, SC-38, SC-4, SC-7, SC-8, SI-3, SI-4, SI-5, SI-6, SI-7Platform Manager(s)YesSecurityAll Available Log Sources

700

CCF: Privileged Account Modification Inv

This investigation provides details around modifications made to privileged accounts within the environment. This investigation requires the CCF: Privileged Accounts (user list) to be established and updated periodically.

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.16, 3.13.2, 3.13.4, 3.13.8, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-2, AC-20, AC-21, AC-23, AC-24, AC-25, AC-3, AC-6, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-2, MA-3, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-4, PS-5, PS-7, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-10, SA-18, SA-19, SA-4, SA-5, SA-9, SC-18, SC-2, SC-28, SC-3, SC-36, SC-38, SC-4, SC-7, SC-8, SI-3, SI-4, SI-5, SI-6, SI-7Data Processor(s)YesAuditAll Available Log Sources

703

CCF: Rogue Access Point Inv

This investigation provides a summary of all detected rogue wireless access points by Impacted Host across critical, production, and online banking environments (entity structure).

Augment: 3.1.12, 3.1.3, 3.13.1, 3.13.15, 3.13.2, 3.14.1, 3.14.2, 3.14.3, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.6.1, 3.6.2, 3.6.3, AC-16, AC-17, AC-18, AC-20, AC-23, AC-4, AU-12, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, PE-17, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-5, PR.DS-1, PR.DS-2, PR.DS-5, PR.IP-9, PR.PT-1, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SA-9, SC-18, SC-2, SC-24, SC-27, SC-31, SC-36, SC-38, SC-4, SC-40, SC-7, SC-8, SI-14, SI-2, SI-3, SI-4, SI-5, SI-7, SI-8Platform Manager(s)YesSecurityAll Available Log Sources

680

CCF: Signature Activity Inv

This investigation provides summary information on signature update activity across critical and production environments (entity structure).

Augment: 3.1.10, 3.1.12, 3.1.2, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.4.2, 3.4.3, 3.4.6, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, AC-16, AC-20, AC-23, AC-4, AU-12, AU-14, AU-15, AU-3, AU-5, AU-6, AU-7, CA-2, CA-7, CM-11, CM-12, CM-3, CM-5, CM-6, CM-7, CM-8, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-2, IA-3, IA-4, IA-5, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IR-10, IR-4, IR-6, IR-7, IR-9, MA-2, MA-3, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-5, PR.AC-7, PR.DS-3, PR.DS-5, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-10, SA-18, SA-19, SA-3, SA-4, SA-5, SA-9, SC-16, SC-18, SC-2, SC-24, SC-27, SC-31, SC-36, SC-38, SC-4, SC-7, SI-11, SI-17, SI-2, SI-3, SI-4, SI-5, SI-7LogMart(s)YesOperationsAll Available Log Sources

681

CCF: Social Media Inv

Summarizes the top URLs related to Social Media activity.

Augment: 3.1.10, 3.1.12, 3.1.19, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.13.4, 3.13.8, 3.14.1, 3.14.2, 3.14.3, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.6.1, 3.6.2, 3.6.3, 3.8.1, 3.8.2, AC-16, AC-20, AC-21, AC-23, AC-4, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-2, IA-3, IA-4, IA-5, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IR-10, IR-4, IR-6, IR-7, IR-9, MA-5, MA-6, MP-2, MP-4, MP-8, PA-4, PE-17, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-5, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.IP-9, PR.PT-1, PR.PT-2, PS-7, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-4, SA-9, SC-28, SC-36, SC-38, SC-7, SI-12, SI-16, SI-3, SI-4, SI-5, SI-7Platform Manager(s)NoAuditAll Available Log Sources

695

CCF: Suspected Wireless Attack Inv

This investigation provides information on suspected wireless attacks at the internal boundary including the type of attack and impacted (targeted) host and application (if applicable). This is based on Critical and Production environments (can be defined with entity structure).

Augment: 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.2, 3.1.20, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.14.1, 3.14.2, 3.14.3, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.6.1, 3.6.2, 3.6.3, 3.8.1, 3.8.2, AC-16, AC-18, AC-20, AC-23, AC-4, AU-12, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-2, IA-3, IA-4, IA-5, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-4, PE-17, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-5, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.IP-9, PR.PT-1, PR.PT-2, PR.PT-4, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SA-4, SA-9, SC-18, SC-2, SC-24, SC-27, SC-31, SC-36, SC-38, SC-4, SC-40, SC-7, SC-8, SI-14, SI-3, SI-4, SI-5, SI-7, SI-8Platform Manager(s)YesSecurityAll Available Log Sources

682

CCF: Suspicious Users Inv

This investigation lists all users generating suspicious activity ordered by the number of events detected highest to lowest.

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.13.4, 3.14.1, 3.14.2, 3.14.3, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.9, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.8.1, 3.8.2, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-2, AC-20, AC-21, AC-23, AC-24, AC-25, AC-6, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-2, MA-3, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.IP-9, PR.PT-1, PR.PT-2, PR.PT-4, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-10, SA-18, SA-19, SA-4, SA-9, SC-2, SC-28, SC-3, SC-36, SC-38, SC-4, SC-7, SI-14, SI-3, SI-4, SI-5, SI-6, SI-7, SI-8Data ProcessorsYesSecurityAll Available Log Sources

685

CCF: Time Sync Error Inv

This investigation provides a summary of time sync errors occurring within critical and production environments (can be defined with entity structure).

Augment: 3.1.12, 3.1.3, 3.13.1, 3.13.15, 3.13.2, 3.14.1, 3.14.2, 3.14.3, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.6.1, 3.6.2, 3.6.3, AC-16, AC-20, AC-23, AU-11, AU-12, AU-14, AU-15, AU-3, AU-4, AU-5, AU-6, AU-7, AU-8, CA-2, CA-7, CP-13, CP-7, CP-9, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IR-10, IR-4, IR-6, IR-7, IR-9, PL-8, PL-9, PM-12, PM-14, PM-17, PM-26, PM-6, PR.DS-4, PR.IP-4, PR.IP-9, PR.PT-1, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-9, SC-18, SC-24, SC-27, SC-31, SC-36, SC-38, SC-7, SI-11, SI-17, SI-3, SI-4, SI-5, SI-7Platform Manager(s)YesOperationsAll Available Log Sources

683

CCF: Unknown User Account Inv

This investigation provides detail of activity from unknown user accounts, based off of CCF user lists.

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.16, 3.13.2, 3.13.4, 3.13.8, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-2, AC-20, AC-21, AC-23, AC-24, AC-25, AC-3, AC-4, AC-6, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-4, PS-5, PS-7, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-10, SA-18, SA-19, SA-4, SA-5, SA-9, SC-18, SC-2, SC-24, SC-27, SC-28, SC-3, SC-31, SC-36, SC-38, SC-4, SC-40, SC-7, SC-8, SI-14, SI-3, SI-4, SI-5, SI-6, SI-7, SI-8Data Processor(s)YesSecurityAll Available Log Sources

697

CCF: Use Of Non-Encrypted Protocols Inv

This investigation lists any use of non-encrypted protocols.

Augment: 3.1.10, 3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.16, 3.13.2, 3.13.4, 3.13.8, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.8, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.10, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.8.1, 3.8.2, 3.8.7, 3.8.8, AC-10, AC-16, AC-17, AC-18, AC-20, AC-21, AC-23, AC-24, AC-25, AC-4, AC-6, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, AU-9, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-8, PL-9, PM-12, PM-17, PM-23, PM-26, PM-6, PR.AC-3, PR.AC-5, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-6, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SA-4, SA-9, SC-13, SC-16, SC-18, SC-2, SC-28, SC-36, SC-38, SC-4, SC-40, SC-7, SC-8, SI-12, SI-16, SI-18, SI-19, SI-20, SI-3, SI-4, SI-5, SI-7LogMart(s)YesAuditAll Available Log Sources

686

CCF: User Misuse Inv

This investigation summarizes detected misuse by user.

Augment: 3.1.10, 3.1.12, 3.1.2, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.14.1, 3.14.2, 3.14.3, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.9, 3.6.1, 3.6.2, 3.6.3, 3.8.1, 3.8.2, AC-10, AC-16, AC-17, AC-20, AC-21, AC-23, AC-24, AC-25, AC-6, AU-10, AU-12, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-3, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.IP-9, PR.PT-1, PR.PT-2, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-10, SA-18, SA-19, SA-4, SA-9, SC-18, SC-2, SC-28, SC-36, SC-38, SC-4, SC-7, SI-14, SI-3, SI-4, SI-5, SI-7, SI-8Platform Manager(s)NoSecurityAll Available Log Sources

687

CCF: Vulnerability Detected Inv

This investigation provides a summary of potential vulnerabilities detected across the critical and production environments (can be defined with entity structure).

Augment: 3.1.12, 3.1.3, 3.13.1, 3.13.15, 3.13.2, 3.14.1, 3.14.2, 3.14.3, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.6.1, 3.6.2, 3.6.3, AC-16, AC-20, AC-23, AC-4, AU-12, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-4, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-5, PR.DS-5, PR.IP-9, PR.PT-1, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SA-9, SC-18, SC-2, SC-24, SC-27, SC-31, SC-36, SC-38, SC-4, SC-40, SC-7, SI-14, SI-3, SI-4, SI-5, SI-7, SI-8Platform Manager(s)YesSecurityAll Available Log Sources

684

CCF: Enabled Account Inv

This investigation provides detailed information when any new accounts are granted (enabled) across any logged environments (entity structure).

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.13.4, 3.13.8, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-2, AC-20, AC-21, AC-23, AC-24, AC-25, AC-3, AC-4, AC-6, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-4, PS-5, PS-7, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SA-4, SA-5, SA-9, SC-18, SC-2, SC-24, SC-27, SC-28, SC-3, SC-31, SC-36, SC-38, SC-4, SC-40, SC-7, SC-8, SI-3, SI-4, SI-5, SI-6, SI-7, SI-8Platform Manager(s)YesAuditAll Available Log Sources

704

CCF: Disabled Account Inv

This investigation provides detailed information when any new accounts are revoked (disabled) across any logged environments (entity structure).

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.13.4, 3.13.8, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-2, AC-20, AC-21, AC-23, AC-24, AC-25, AC-3, AC-4, AC-6, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-4, PS-5, PS-7, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SA-4, SA-5, SA-9, SC-18, SC-2, SC-24, SC-27, SC-28, SC-3, SC-31, SC-36, SC-38, SC-4, SC-40, SC-7, SC-8, SI-3, SI-4, SI-5, SI-6, SI-7, SI-8Platform Manager(s)NoAuditAll Available Log Sources

705

CCF: Deleted Account Inv

This investigation provides detailed information when any new accounts are deleted across any logged environments (entity structure).

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.13.4, 3.13.8, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-2, AC-20, AC-21, AC-23, AC-24, AC-25, AC-3, AC-4, AC-6, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-4, PS-5, PS-7, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SA-4, SA-5, SA-9, SC-18, SC-2, SC-24, SC-27, SC-28, SC-3, SC-31, SC-36, SC-38, SC-4, SC-40, SC-7, SC-8, SI-3, SI-4, SI-5, SI-6, SI-7, SI-8Platform Manager(s)YesAuditAll Available Log Sources

706

CCF: Denial of Service Inv

This investigation provides details of detected denial of service attempts.

Augment: 3.1.12, 3.1.3, 3.13.1, 3.13.15, 3.13.2, 3.14.1, 3.14.2, 3.14.3, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.6.1, 3.6.2, 3.6.3, AC-16, AC-20, AC-23, AC-4, AU-12, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-4, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, PL-8, PL-9, PM-12, PM-17, PM-26, PR.AC-5, PR.DS-5, PR.IP-9, PR.PT-1, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SA-9, SC-18, SC-2, SC-24, SC-27, SC-31, SC-36, SC-38, SC-4, SC-5, SC-7, SI-14, SI-3, SI-4, SI-5, SI-7, SI-8Data Processor(s)YesAuditAll Available Log Sources

707

CCF: Excessive Authentication Failure Inv

This investigation provides detailed information around excessive user account authentication failures (>10 authentication failures in 30 minutes) across any logged environments (entity structure).

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.13.4, 3.13.8, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-2, AC-20, AC-21, AC-23, AC-24, AC-25, AC-3, AC-4, AC-6, AC-7, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SA-4, SA-5, SA-9, SC-18, SC-2, SC-24, SC-27, SC-28, SC-3, SC-31, SC-36, SC-38, SC-4, SC-40, SC-7, SC-8, SI-3, SI-4, SI-5, SI-6, SI-7, SI-8Platform Manager(sNoAuditAll Available Log Sources

708

CCF: User Object Access Inv

This investigation summarizes successful object access activity by user.

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.21, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.13.4, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.8, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.8.7, 3.8.8, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-2, AC-20, AC-21, AC-23, AC-24, AC-25, AC-3, AC-4, AC-6, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, AU-9, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-7, CP-9, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-3, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-2, MA-3, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-23, PM-26, PM-6, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-4, PR.IP-6, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-4, PS-5, PS-7, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-10, SA-18, SA-19, SA-4, SA-5, SA-9, SC-2, SC-28, SC-3, SC-36, SC-38, SC-4, SC-7, SI-12, SI-16, SI-18, SI-19, SI-20, SI-3, SI-4, SI-5, SI-6, SI-7Data Processor(s)NoAuditAll Available Log Sources

694

CCF: Account Modification Inv

This investigation provides details around account modifications across the environment.

Augment: 3.1.1, 3.1.10, 3.1.12, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.3, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.13.1, 3.13.15, 3.13.2, 3.13.4, 3.13.8, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.6, 3.14.7, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.9, 3.4.2, 3.4.3, 3.4.6, 3.5.1, 3.5.2, 3.5.3, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.8.1, 3.8.2, 3.9.2, AC-10, AC-16, AC-17, AC-18, AC-2, AC-20, AC-21, AC-23, AC-24, AC-25, AC-3, AC-4, AC-6, AU-10, AU-12, AU-13, AU-14, AU-15, AU-3, AU-6, AU-7, CA-2, CA-7, CM-12, CM-3, CM-5, CM-6, CM-7, CP-13, CP-7, DE.AE-2, DE.AE-3, DE.AE-4, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-5, IA-10, IA-12, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, ID.AM-4, ID.AM-5, ID.RA-3, ID.SC-3, ID.SC-4, IP-2, IP-4, IR-10, IR-4, IR-5, IR-6, IR-7, IR-9, MA-4, MA-5, MA-6, MP-2, MP-4, MP-7, MP-8, PA-3, PA-4, PE-17, PL-4, PL-8, PL-9, PM-12, PM-17, PM-26, PM-6, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.DS-1, PR.DS-2, PR.DS-5, PR.DS-8, PR.IP-1, PR.IP-3, PR.IP-9, PR.MA-1, PR.MA-2, PR.PT-1, PR.PT-2, PR.PT-3, PR.PT-4, PS-4, PS-5, PS-8, RA-2, RA-3, RA-7, RC.RP-1, RS.AN-1, RS.AN-3, RS.AN-4, RS.CO-2, RS.MI-2, RS.MI-3, RS.RP-1, SA-18, SA-19, SA-4, SA-5, SA-9, SC-18, SC-2, SC-24, SC-27, SC-28, SC-3, SC-31, SC-36, SC-38, SC-4, SC-40, SC-7, SC-8, SI-3, SI-4, SI-5, SI-6, SI-7, SI-8Platform Manager(s)NoAuditAll Available Log Sources

709

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.