Financial entities shall have in place mechanisms to promptly detect anomalous activities, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure.
JSON configuration export of monitoring tools, alert thresholds, anomaly detection rules, and SIEM configurations as required by DORA Article 10.
ict-monitoring-configGenerated example artifact using the default institution profile (COMMON availability, synthetic data only).
{
"configVersion": "2.3",
"exportDate": "2025-01-10",
"institution": "Nordvik Bank AG",
"exportedBy": "Security Operations Manager",
"monitoringTools": [
{
"toolId": "MON-001",
"name": "Splunk Enterprise",
"category": "SIEM",
"version": "9.2.1",
"deployment": "On-premises (Zurich DC-1)",
"logSourcesConnected": 47,
"eventsPerSecond": 12500,
"retentionDays": 365,
"status": "Active"
},
{
"toolId": "MON-002",
"name": "CrowdStrike Falcon",
"category": "EDR",
"version": "7.10",
"deployment": "Cloud-managed",
"endpointsCovered": 1389,
"status": "Active"
},
{
"toolId": "MON-003",
"name": "Palo Alto Cortex XSOAR",
"category": "SOAR",
"version": "8.5",
"deployment": "On-premises (Zurich DC-1)",
"playbooksActive": 28,
"status": "Active"
},
{
"toolId": "MON-004",
"name": "Qualys VMDR",
"category": "Vulnerability Management",
"version": "Cloud",
"deployment": "Cloud-managed",
"assetsScanned": 1247,
"scanFrequency": "Weekly (external), Monthly (internal)",
"status": "Active"
},
{
"toolId": "MON-005",
"name": "Darktrace Enterprise",
"category": "Network Anomaly Detection",
"version": "6.1",
"deployment": "On-premises (Zurich DC-1)",
"networkSegmentsMonitored": 5,
"status": "Active"
}
],
"alertRules": {
"totalRules": 342,
"byCategory": {
"authentication_anomaly": 45,
"privilege_escalation": 38,
"data_exfiltration": 32,
"malware_detection": 52,
"network_anomaly": 41,
"policy_violation": 28,
"system_availability": 35,
"configuration_change": 22,
"third_party_integration": 18,
"compliance_monitoring": 31
},
"bySeverity": {
"critical": 48,
"high": 87,
"medium": 124,
"low": 83
},
"sampleRules": [
{
"ruleId": "ALR-AUTH-001",
"name": "Multiple Failed Authentication — Critical System",
"severity": "High",
"condition": "5+ failed login attempts within 10 minutes on critical systems",
"action": "Alert SOC analyst; auto-lock account after 10 attempts",
"lastTriggered": "2025-01-08T14:23:00Z"
},
{
"ruleId": "ALR-PRIV-001",
"name": "Privileged Account Used Outside Business Hours",
"severity": "High",
"condition": "Privileged account login between 22:00-06:00 CET on non-change-window days",
"action": "Alert SOC analyst; require justification within 4 hours",
"lastTriggered": "2025-01-06T03:15:00Z"
},
{
"ruleId": "ALR-DATA-001",
"name": "Large Data Transfer to External Destination",
"severity": "Critical",
"condition": "Outbound data transfer >500MB to non-whitelisted destination",
"action": "Alert SOC analyst immediately; auto-block if confidence >80%",
"lastTriggered": "2024-12-19T11:42:00Z"
},
{
"ruleId": "ALR-NET-001",
"name": "Anomalous Network Traffic Pattern",
"severity": "Medium",
"condition": "Darktrace model breach score >75% for any device",
"action": "Alert SOC analyst; initiate investigation workflow",
"lastTriggered": "2025-01-09T08:55:00Z"
}
]
},
"detectionCoverage": {
"overallCoveragePercent": 87.5,
"byZone": {
"production": 95.0,
"dmz": 92.0,
"management": 88.0,
"user": 82.0,
"development": 68.0
},
"knownGaps": [
"Cloud-native services (AWS Lambda, API Gateway) — partial log integration",
"Development environment — limited monitoring coverage",
"IoT devices (building management) — not integrated with SIEM"
]
},
"singlePointsOfFailureMonitored": true,
"spofMonitoringDetails": [
{
"spofId": "SPOF-001",
"description": "SWIFT Alliance Gateway",
"monitoringMethod": "Heartbeat check every 30 seconds; transaction throughput monitoring",
"alertThreshold": "No heartbeat for 2 minutes or throughput drop >50%"
},
{
"spofId": "SPOF-002",
"description": "SAN Storage Infrastructure",
"monitoringMethod": "SNMP monitoring of disk health, I/O latency, and replication status",
"alertThreshold": "Disk failure, I/O latency >50ms, or replication lag >5 minutes"
}
]
}
Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).
ict_detection_capabilities_status — fs-ict-detection-capabilities
{
"factId": "c1d2e3f4-a5b6-7890-cdef-100000000011",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-100000000011",
"evidenceClassId": "ict-detection-capabilities",
"factType": "ict_detection_capabilities_status",
"data": {
"assessment_date": "2025-01-10",
"has_anomaly_detection": true,
"has_siem": true,
"monitoring_coverage_percent": 87.5,
"single_points_of_failure_monitored": true,
"alert_rules_count": 342,
"mean_time_to_detect_hours": 2.3
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-01-15T09:00:00Z",
"supersededBy": null
}
Plain text summary of the institution's detection capabilities, including coverage assessment, detection gaps, and improvement roadmap.
ict-detection-capabilitiesGenerated example artifact using the default institution profile (COMMON availability, synthetic data only).
ICT DETECTION CAPABILITIES SUMMARY
Nordvik Bank AG
Assessment Date: 10 January 2025
Prepared by: SOC Manager (Katrin Halvorsen, CISO oversight)
Next Assessment: 10 January 2026
Classification: Internal — Restricted
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
DETECTION CAPABILITY OVERVIEW
Nordvik Bank AG operates a multi-layered detection capability designed to identify
anomalous activities, ICT-related incidents, and potential material single points
of failure in accordance with DORA Article 10.
The detection architecture comprises five integrated components:
1. SIEM Platform (Splunk Enterprise 9.2.1)
— Centralised log collection from 47 sources across all security zones
— 342 active correlation rules covering 10 threat categories
— Real-time alerting with automated triage via SOAR integration
— Average event ingestion: 12,500 events per second
2. Endpoint Detection and Response (CrowdStrike Falcon 7.10)
— Deployed on 1,389 endpoints (servers and workstations)
— Behavioural analysis with machine learning-based threat detection
— Automated containment for high-confidence malware detections
— Coverage: 98% of managed endpoints
3. Network Anomaly Detection (Darktrace Enterprise 6.1)
— Unsupervised machine learning monitoring all five network zones
— Self-learning baseline of normal network behaviour
— Real-time detection of lateral movement, C2 communication, and
data exfiltration patterns
— Integration with SIEM for correlated alerting
4. Vulnerability Management (Qualys VMDR)
— Continuous vulnerability scanning of 1,247 assets
— Weekly external scans, monthly internal scans
— Automated prioritisation based on asset criticality and exploit
availability
5. Security Orchestration (Palo Alto Cortex XSOAR 8.5)
— 28 automated playbooks for common alert types
— Automated enrichment of alerts with threat intelligence
— Mean time to triage reduction: 65% since deployment
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
COVERAGE ASSESSMENT
Overall Detection Coverage: 87.5%
Coverage by Security Zone:
Zone Coverage Assessment
─────────────────────────────────────────────────────────────────────────────
Production 95.0% Strong — all critical systems fully monitored
with real-time alerting and automated response
DMZ 92.0% Strong — web application firewall, IDS/IPS,
and full packet capture active
Management 88.0% Adequate — privileged access monitoring and
configuration change detection active
User 82.0% Adequate — EDR coverage good; email security
gateway and DLP active; some gaps in cloud
application monitoring
Development 68.0% Below target — limited monitoring; reliance
on network-level detection only
Coverage by Threat Category (MITRE ATT&CK alignment):
Tactic Coverage Key Detection Methods
─────────────────────────────────────────────────────────────────────────────
Initial Access 85% Email gateway, WAF, IDS/IPS
Execution 80% EDR behavioural analysis, SIEM rules
Persistence 75% EDR, configuration monitoring
Privilege Escalation 82% PAM monitoring, SIEM correlation
Defence Evasion 70% EDR, Darktrace anomaly detection
Credential Access 88% PAM, authentication monitoring
Discovery 72% Darktrace, SIEM network rules
Lateral Movement 78% Darktrace, network segmentation alerts
Collection 75% DLP, SIEM data access rules
Exfiltration 80% DLP, Darktrace, proxy monitoring
Command and Control 82% DNS monitoring, Darktrace, IDS/IPS
Impact 85% System availability monitoring, EDR
Mean Time to Detect (MTTD): 2.3 hours (target: <4 hours)
Mean Time to Respond (MTTR): 4.1 hours (target: <8 hours)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
KNOWN GAPS
Gap ID Area Severity Description
─────────────────────────────────────────────────────────────────────────────────
GAP-001 Cloud-Native Services Medium AWS Lambda functions and API
Gateway logs partially integrated
with SIEM. Serverless execution
events not fully captured.
GAP-002 Development Environment Low Development zone has network-level
monitoring only. No EDR or SIEM
agent deployment on dev servers.
GAP-003 IoT/Building Management Low Building management system (HVAC,
physical access) not integrated
with SIEM. Separate monitoring by
facilities team.
GAP-004 Encrypted Traffic Inspection Medium East-west encrypted traffic within
the production zone is not subject
to TLS inspection. Relies on
endpoint-level detection.
GAP-005 User Behaviour Analytics Medium No dedicated UEBA solution for
detecting insider threats based on
behavioural patterns. Current
detection relies on rule-based
SIEM alerts.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
IMPROVEMENT ROADMAP
Priority Initiative Target Date Budget (CHF)
─────────────────────────────────────────────────────────────────────────────
High Complete AWS CloudTrail and Q1 2025 45,000
Lambda log integration with SIEM
High Deploy UEBA solution for insider Q2 2025 180,000
threat detection (Exabeam or
Microsoft Sentinel UEBA module)
Medium Implement TLS inspection for Q2 2025 75,000
east-west production traffic
Medium Extend EDR deployment to Q1 2025 15,000
development environment
Low Integrate building management Q3 2025 25,000
system alerts with SIEM
Low Implement MITRE ATT&CK-based Q2 2025 —
detection coverage mapping and
gap analysis (internal effort)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Assessment conducted by: SOC Manager
Reviewed by: Katrin Halvorsen, CISO
Date: 10 January 2025
Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).
ict_detection_capabilities_status — fs-ict-detection-capabilities
{
"factId": "c1d2e3f4-a5b6-7890-cdef-100000000011",
"evidenceId": "a0b1c2d3-e4f5-6789-abcd-100000000011",
"evidenceClassId": "ict-detection-capabilities",
"factType": "ict_detection_capabilities_status",
"data": {
"assessment_date": "2025-01-10",
"has_anomaly_detection": true,
"has_siem": true,
"monitoring_coverage_percent": 87.5,
"single_points_of_failure_monitored": true,
"alert_rules_count": 342,
"mean_time_to_detect_hours": 2.3
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-01-15T09:00:00Z",
"supersededBy": null
}
fs-ict-detection-capabilitiesDORA-Art10-P1assessment_datemonitoring_coverage_percent{
"properties": {
"alert_rules_count": {
"minimum": 0,
"type": "integer"
},
"assessment_date": {
"format": "date",
"type": "string"
},
"has_anomaly_detection": {
"type": "boolean"
},
"has_siem": {
"type": "boolean"
},
"mean_time_to_detect_hours": {
"minimum": 0,
"type": "number"
},
"monitoring_coverage_percent": {
"maximum": 100,
"minimum": 0,
"type": "number"
},
"single_points_of_failure_monitored": {
"type": "boolean"
}
},
"required": [
"assessment_date",
"has_anomaly_detection",
"has_siem",
"monitoring_coverage_percent"
],
"type": "object"
}