System and Log Monitoring Sample Clauses

System and Log Monitoring. 1. Information Systems must be monitored to detect attacks, potential attacks, and indicators of compromise, identifying unauthorized, suspicious, and unusual activity. Every Information System must have designated individuals responsible for such monitoring, which group may comprise Owners, system administrators, agency staff, EOHHS staff, EOTSS staff, contractors, or other authorized parties. They must identify and analyze unauthorized and unusual activity/conditions using audits, log review, event correlation engines (e.g., XXXX), user behavior analytics, or other methodology, and initiate the incident response process when appropriate. Monitoring must cover activity on local systems, over the local network, via remote connections, and over connections to vendors/contractors/other third parties (including inbound and outbound traffic). 2. In addition to monitoring capabilities within Information Systems, Owners must ensure that independent monitoring devices (intrusion detection systems, web application firewalls, etc.) are deployed (i) strategically throughout the infrastructure (alongside Information Systems) to collect essential information such as authentication and authorization metadata;