Implementation examples

4 examples referencing EDR

• IR.L2-3.6.3[a]

  Two tabletops and one live containment drill a year, with findings that close

  AO coverage. Addresses the Incident Response Testing objective: the incident response capability is tested. Annual test plan. Three exercises a year, scheduled in January so calendars are held: a…

  • IR tabletop
  • Ticketing
  • EDR

  CCControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet
• SI.L2-3.14.6[a] [b] [c]

  Inbound, outbound, and off-network telemetry with business-hours triage and on-call paging

  AO coverage. Addresses all three Monitor Communications for Attacks objectives: the system is monitored, inbound traffic is monitored, and outbound traffic is monitored. System monitoring [a]. EDR…

  • NGFW
  • DNS filtering
  • EDR
  • SIEM

  CCControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet
• SC.L2-3.13.13[a] [b]

  Macro and script allow-listing, with execution telemetry landing in the SIEM

  AO coverage. Addresses both Mobile Code objectives: use of mobile code is controlled, and use of mobile code is monitored. What counts as mobile code here. Office macros and add-ins, browser…

  • Microsoft Defender
  • Managed browser
  • EDR
  • SIEM

  CCControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet
• AU.L2-3.3.5[a] [b]

  One investigation timeline across identity, endpoint, network, and file-server events

  AO coverage. Addresses both Audit Correlation objectives: the review, analysis, and reporting processes are defined, and those processes are correlated across sources rather than run independently.…

  • Splunk Enterprise Security
  • EDR
  • NGFW
  • Case management

  CCControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet