SI-4 — System Monitoring | Defense Map

NIST SP 800-53 control context

SI-4 — System Monitoring

System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at external interfaces to the system. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives guide and inform the determination of the events. System monitoring capabilities are achieved through a variety of tools and techniques, including intrusion detection and prevention systems, malicious code protection software, scanning tools, audit record monitoring software, and network monitoring software. Depending on the security architecture, the distribution and configuration of monitoring devices may impact throughput at key internal

Read the official statement, discussion, parameters, enhancements, and assessment methods →

Outcome layer

NIST CSF 2.0 informative references

These CSF Subcategories list this base control or one of its enhancements in the imported NIST informative reference.

DE.AE-02Analyze Potentially Adverse EventsSI-4 DE.AE-03Correlate Information from Multiple SourcesSI-4 DE.CM-01Monitor Networks and Network ServicesSI-4 DE.CM-06Monitor External Service ProvidersSI-4 DE.CM-09Monitor Computing and Runtime EnvironmentsSI-4 ID.IM-01Improvements from EvaluationsSI-4 ID.IM-02Improvements from Tests and ExercisesSI-4 ID.IM-03Improvements from OperationsSI-4 ID.RA-01Identify and Record VulnerabilitiesSI-4 PR.DS-01Protect Data at RestSI-4 PR.DS-02Protect Data in TransitSI-4 PR.DS-10Protect Data in UseSI-4

CUI protection layer

NIST SP 800-171 and SP 800-172

SP 800-171 requirements sourcing this control

03.14.06System MonitoringSI-4

SP 800-172 enhanced requirements sourcing this control

03.11.09EIndicators of CompromiseSI-4(24)03.14.17ESystem-Generated AlertsSI-4(5)03.14.18EAutomated Organization-Generated AlertsSI-4(12)03.14.19EWireless Intrusion DetectionSI-4(14)

Defensive engineering layer

MITRE D3FEND techniques

D3-NTANetwork Traffic Analysisnarrower · SI-4(2)D3-NTANetwork Traffic Analysisnarrower · SI-4(4)D3-OSMOperating System Monitoringbroader · SI-4

Adversary layer

MITRE ATT&CK relationships

Curated mitigation mappings

M1020SSL/TLS InspectionCurated through D3-NTA M1021Restrict Web-Based ContentCurated through D3-NTA M1031Network Intrusion PreventionCurated through D3-NTA

Inferred behavior relationships

Experimental: These relationships are inferred through D3FEND and must be validated against architecture, telemetry, and threat context.

Show 106 additional relationships

T1070.002Clear Linux or Mac System LogsInferred through D3-OSM

T1562.001Disable or Modify ToolsInferred through D3-OSM

T1562.009Safe Mode BootInferred through D3-OSM

T1562.013Disable or Modify Network Device FirewallInferred through D3-OSM

Relationship boundaries

Use the map without overclaiming.

A CSF informative reference is not an equivalence statement. A source-control relationship is not proof of implementation. A D3FEND semantic relationship is not a product claim. An inferred ATT&CK link is a hypothesis for engineering analysis.

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST or MITRE. Informative references and cross-framework relationships support navigation and analysis; they do not establish compliance, applicability, equivalence, control inheritance, or guaranteed mitigation effectiveness.