Detect 2.4 Detect 2.4.1 Anomalies and events Ensure that anomalies (abnormal behaviours) and security-related events are detected swiftly and that the potential impact of incidents is understood. Description Task DE.AE-1 Define a baseline for permitted network operations and expected data flows for users and systems. Manage these values continuously. DE.AE-2 Ensure that detected cybersecurity incidents are analysed to understand their targets and methods. DE.AE-3 Ensure that information on cybersecurity incidents is aggregated and correlated from multiple sources and sensors. DE.AE-4 Determine the impact of possible events. DE.AE-5 Define the thresholds above which cybersecurity incidents trigger an alert. Table 27: DE.AE tasks Standard Reference COBIT 5 DSS03.01, APO12.06 ISA 62443-3:2013 SR 2.8, SR 2.9, SR 2.10, SR 2.11, SR 2.12, SR 3.9, SR 6.1, SR 6.2 ISO 27001:2013 NIST-SP-800-53 Rev. 4 AC-4, CA-3, CM-2, SI-4, AU-6, CA-7, IR-4, IR-5, IR-8, SI-4 BSI B 1.8 Table 28: DE.AE references Minimum ICT standard 2018 27