GRCLibrary.ai

Procedure

Security Monitoring and Alert Management Procedure

To ensure that security events from all production systems and environments are collected, normalized, correlated, and acted upon in a timely and consistent manner. This procedure operationalizes the control requirements established in the Logging and Monitoring Standard, providing the Security Operations Centre (SOC) with a clear and repeatable workflow from log ingestion through alert closure or escalation to the Incident Response Procedure.

Type
Procedure
Version
1.4.2
Date
2026-10-27
Owner
Chief Information Security Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Operations
Review frequency
Annual and upon material platform or regulatory change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • 1. Purpose and scope
  • 2. Governance
  • 3. Log ingestion and normalization
  • 4. SIEM alert rule catalogue
  • 5. Alert triage workflow
  • 6. Automated ticket creation
  • 7. Escalation paths
  • 8. Dashboard and reporting
  • 9. SIEM rule tuning and maintenance
  • 10. AI-assisted detection
  • 11. Metrics
  • 12. Framework alignment

Frameworks it maps to

Related documents