Procedure
Threat Intelligence and SIEM Operations Procedure
This procedure defines the operational processes for managing threat intelligence, operating the Security Information and Event Management (SIEM) platform, developing and maintaining correlation rules, conducting threat hunting, and sharing intelligence with sector peers. It establishes the practices by which threat intelligence is operationalized into detection capability and feeds back into continual improvement of the organization's security posture.
- Type
- Procedure
- Version
- 1.3.18
- Date
- 2026-11-03
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Operations
- Review frequency
- Annual and upon material platform or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose and scope
- 2. Governance
- 3. Threat intelligence sources
- 4. Indicator management lifecycle
- 5. SIEM correlation rule development
- 6. SIEM platform operations
- 7. Threat hunting
- 8. Intelligence sharing and escalation
- 9. SIEM rule tuning
- 10. Metrics
- 11. Framework alignment
Frameworks it maps to
- NIST SP 800-150
- ISO/IEC 27001:2022 Annex A.5.7
- CSA CCM TVM-01, TVM-04, TVM-05
- GC Cyber Security Event Management Plan §2.3.1.1 and §2.3.1.2 (Government of Canada organizations; held text: date modified 2026-05-20, currency to be confirmed upstream)
- CSA CCM LOG-03, LOG-05
- NIST CSF 2.0 DE.CM-01, DE.CM-09
- ISO/IEC 27002:2022 §8.16
- NIST SP 800-92 §5.5
- MITRE ATT&CK Enterprise
- NIST SP 800-53 Rev. 5 SI-4
- CSA CCM LOG-05
- MITRE ATT&CK
- NIST CSF 2.0 DE.AE-02, DE.AE-03, DE.AE-07
- NIST SP 800-150 §4
- CISA TLP Policy
- ISO/IEC 27035-1:2023, ISO/IEC 27035-2:2023
- NIST SP 800-61 Rev. 3
- CSA CCM SEF-06, SEF-07
- NIST AI RMF 1.0 (NIST AI 100-1)
- COBIT 2019 DSS05
- ISO/IEC 27001:2022 Annex A.5.33
Related documents
- Logging and Monitoring Standardsecurity
- Security Monitoring and Alert Management Procedureoperations
- Security Incident Response Proceduresecurity
Next
All Documents