DE.AE-03 - Correlating Data from Multiple Sources

DE.AE-03 correlates information from diverse sources—like logs, sensors, and threat intelligence—to build a unified picture of potential adverse events. This involves consolidating log data into centralized servers and using event correlation tools (e.g., SIEM) to identify patterns or connections. It enhances detection by linking disparate clues into coherent threats.

This subcategory strengthens analysis by integrating external intelligence with internal data, improving the accuracy of event characterization. It supports a holistic view of the threat landscape, aligning correlation with risk priorities. DE.AE-03 amplifies the power of individual monitoring efforts.