SEC04-BP03 Correlate and enrich security alerts
Enrich findings with asset, identity, business owner and threat intel context so responders can triage quickly, and correlate signals across GuardDuty, Security Hub and other tools.
4
artefacts
1
held by a system
0
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Enrichment pipeline architecture · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Asset inventory feed to SIEM · Policy repository / GRC workspace
- Correlation rule documentation · Policy repository / GRC workspace
- Ownership tags · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- raw alerts without context
- no asset to owner mapping
- duplicate alerts across tools
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSEC04-BP02 Capture logs, findings, and metrics in standardized locations · SEC04-BP04 Initiate remediation for non-compliant resources