How can ManageEngine support compliance with the national cyber-incident guide?
With ManageEngine Log360, organizations can align with the guide's requirements through centralized log collection and correlation across networks, systems, and applications, continuous detection of incidents using MITRE-mapped analytics and behavioral anomaly detection, real-time alerting that supports the immediate initial notification and the intermediate and final deadlines, an incident management console that classifies each case by taxonomy and tracks it through every state to closure, and secure, tamper-evident log retention with audit-ready reporting. These capabilities help implement the guide's detection, notification, and management obligations and produce the evidence expected during regulatory scrutiny.
Section 5Section 5 — Classification and taxonomy of cyber incidents
| Clause | Functionality | Explanation |
|---|---|---|
| §5 Assign each registered incident a classification and type from the shared taxonomy when it is reported. | Log360 - Correlation engine, 2000+ MITRE-mapped detections, threat intelligence, UEBA | Log360 assigns each incident a category and type by matching activity against MITRE-mapped detections, correlating events across sources, and enriching them with threat intelligence, so the classification reported to the CSIRT reflects the observed threat. |
Section 6Section 6 — Notification of cybersecurity incidents
| Clause | Functionality | Explanation |
|---|---|---|
| §6.1.1 Assigning the danger level — rate the incident by the intrinsic characteristics of the threat type. | Log360 - 2000+ MITRE-mapped detections, threat intelligence, dark web monitoring, UEBA | Log360 identifies the threat type behind an incident through MITRE-mapped detections, threat feeds, and behavioral analytics, providing the intrinsic-threat evidence needed to set a danger level from critical to low. |
| §6.1.2 Assigning the impact level — evaluate the consequences across systems and services. | Log360 - Security and risk posture assessment, attack surface analysis, real-time security analytics | Log360 gauges the consequences of an incident by identifying misconfigurations and exposed attack surface and by measuring the reach of the event across monitored systems, feeding the share-of-systems and service-interruption criteria the impact level uses. Non-technical impact factors are assessed separately. |
| §6.1.3 Mandatory notification above the threshold — notify high, very high, and critical incidents in time and form. | Log360 - Real-time alerts, correlation rules and alert profiles, audit-ready reports | Log360 raises real-time alerts when an incident reaches a high, very high, or critical level and compiles the audit-ready evidence needed to notify the competent authority in time and form. |
| §6.2 Interacting with the reference CSIRT — manage and track the case through the incident's life. | Log360 - Incident management console, ITIL ticketing integration, incident workflows | Log360's incident management console and ticketing workflows provide the tracking workspace to manage a case with the reference CSIRT across its life. Where the CSIRT's own tools are used, the Log360 record remains the internal case history. |
| §6.3 Opening and registering the incident — record the case, assign initial values, and give it a unique identifier. | Log360 - Incident management console, correlation engine, incident timelines | Log360 registers each case with its own identifier and initial context, assigns an initial classification through correlation, and builds an incident timeline, mirroring the intake performed when a case is opened. |
| §6.4 Supplying the required incident information — report affected assets, origin, taxonomy, severity, and countermeasures. | Log360 - Automatic device discovery, log source inventory, root-cause analysis, audit-ready reports | Log360 produces the technical detail the notification requires, enumerating affected assets and log sources, establishing incident origin through correlation and process-lineage analysis, and exporting taxonomy, severity, and countermeasure detail in audit-ready reports. |
| §6.5 Meeting the reporting windows — send initial, intermediate, and final notifications within the deadlines. | Log360 - Real-time alerting, incident timelines, audit-ready reports | Log360 supports each reporting stage: real-time alerts enable the immediate initial notification, incident timelines feed intermediate updates, and audit-ready reports assemble the final notification within the set windows. |
| §6.6 Tracking incident states and closure — move cases through defined states with closure timings. | Log360 - Incident management console, automated workflows, incident timelines | Log360 tracks each case through its states from open to closed and records the closure reason and timing, aligning with the state model and the no-response closure timings the guide defines. |
Section 7Section 7 — Management of cybersecurity incidents
| Clause | Functionality | Explanation |
|---|---|---|
| §7.1 Preparing people, procedures, and technology — establish monitoring and run risk analysis. | Log360 - Centralized log management, automatic device discovery, security and risk posture assessment | Log360 lays the monitoring groundwork for preparation by centralizing logs across the environment, discovering devices to bring under monitoring, and running posture assessments that support risk analysis. Human and procedural readiness sits outside the product. |
| §7.2 Identifying and detecting incidents — monitor events, detect anomalies, and preserve evidence. | Log360 - Centralized log management, correlation engine, UEBA, threat intelligence | Log360 registers and monitors events across networks, systems, and applications, correlates them to surface anomalies, applies UEBA to detect insider and account-compromise activity, and preserves tamper-proof logs as evidence. |
| §7.3 Containing the incident — limit impact and stop propagation and exfiltration. | Log360 - SOAR workflows, correlation rules and alert profiles, exfiltration detection | Log360 contains an incident through SOAR workflows that execute on detection to disable accounts or isolate endpoints, while its exfiltration and correlation analytics stop data leaving the environment and triage by criticality. |
| §7.4 Mitigating and eradicating — determine causes and remove attacker tooling. | Log360 - Root-cause analysis, process-lineage visuals, SOAR playbooks | Log360 supports mitigation by establishing the causes and symptoms of an incident through root-cause and process-lineage analysis and by recording the eradication steps executed in SOAR playbooks. Rebuilding hosts and restoring backups are performed with endpoint and AD360 tools. |
| §7.5 Recovering to normal operation — return systems to production under heightened monitoring. | Log360 - Real-time security analytics, correlation rules, real-time alerts | Log360 provides the heightened monitoring the recovery phase requires, watching restored systems through real-time analytics and correlation and alerting on any renewed suspicious activity before a case is closed. |
| §7.6 Learning from the incident — capture lessons learned and report cause, cost, and prevention. | Log360 - Incident timelines, root-cause analysis, audit-ready reports | Log360 supports the post-incident review by reconstructing how the incident unfolded, confirming its cause, and producing the documented report on cause, cost, and preventive measures the guide requires. |
Section 8Section 8 — Metrics and indicators
| Clause | Functionality | Explanation |
|---|---|---|
| §8.1 Measuring the reach of the management system — track which services are under monitoring. | Log360 - Compliance dashboards, audit-ready reports, automatic device discovery | Log360 shows which systems and services report telemetry through its dashboards and device discovery, evidencing the coverage the implementation metric tracks. |
| §8.2 Measuring resolution time — track how long cases take from notification to resolution. | Log360 - Incident management console, incident timelines, audit-ready reports | Log360 timestamps each case from open to close and reports closure statistics, supplying the resolution-time figures the metric requires by impact level. |
| §8.4 Measuring incidents closed without response — track the share closed without a response. | Log360 - Incident management console, automated workflows, audit-ready reports | Log360 records the closure reason for every case and reports the proportion closed without response overall and for high-danger cases, producing the figures the metric tracks. |