During a post-incident review, the team identifies that the initial detection time was significantly longer than expected due to missing log sources in the SIEM. How should this finding be addressed in the lessons learned report?

Question

Accepted Answer

A. Document the detection gap as a finding with a specific action plan to onboard the missing log sources. Lessons learned reports must document gaps identified during an incident, including detection failures, with specific, assignable action plans to remediate them. The CySA+ Reporting and Communication domain covers lessons learned, metrics, and KPIs as part of incident response reporting. A missed detection due to log source gaps is a process and architecture improvement item.

During a post-incident review, the team identifies that the initial detection time was significantly longer than expected due to missing log sources in the SIEM. How should this finding be addressed in the lessons learned report?

Related Questions

Discussion