Detection and Response. The Solution shall have the ability to detect and respond to a wide range of security threats, including malware, phishing, insider threats, and zero-day attacks.
Detection and Response. Supplier shall monitor its system for security breaches, violations and suspicious external activity or unauthorized internal system activity. Supplier shall notify Bank of America (promptly within twenty-four (24) hours or as soon thereafter as practicable) through the defined security escalation channel of Bank of America, the Bank of America Computing Incident Response Team (“BACIRT”), in the event of a breach of security or the detection of suspicious activity. Such notification to Bank of America shall precede notifications to any other Party. Supplier shall cooperate fully with all Bank of America security investigation activities and abide by the BACIRT guidelines for escalation and control of significantly security incidents. Bank of America will provide a copy of the guidelines to Supplier, and such guidelines shall be treated as the Confidential Information of Bank of America. Supplier shall maintain for a mutually agreed-upon length of time, and afford Bank of America reasonable access to, all records and logs of that portion of Supplier’s network that stores or processes Confidential Information. Bank of America may review and inspect any record of system activity or Confidential Information handling upon reasonable prior notice. Supplier acknowledges and agrees that records of system activity and of Confidential Information handling may be evidence (subject to appropriate chain of custody procedures) in the event of a security breach or other inappropriate activity. Upon the request of Bank of America, Supplier shall deliver the original copies of such records to Bank of America for use in any legal, investigatory or regulatory proceeding. Supplier shall monitor industry-standard information channels (bugtraq, CERT, OEMs, etc.) for newly identified system vulnerabilities regarding the technologies and services provided to Bank of America and fix or patch any identified security problem in an adequate and timely manner. Unless otherwise expressly agreed in writing, “timely” shall mean that Supplier shall introduce such fix or patch as soon as commercially reasonable after Supplier becomes aware of the security problem. This obligation extends to all devices that comprise Supplier’s system, e.g., application software, databases, servers, firewalls, routers and switches, hubs, etc., and to all of Supplier’s other Confidential Information handling practices. Bank of America may perform vulnerability testing of Supplier’s system to test the remedia...
Detection and Response. 3.1 Tech shall monitor [**]. Tech shall notify Bank [**], in the event of a [**]. Per Section IV of the Supplier Security Requirements, [**] shall be contacted by calling [**] retains the right to make appropriate notifications to [**] shall make no notice to [**] without the written permission, and at the written direction, of [**] shall cooperate fully with all [**].
Detection and Response. The Solution shall have the ability to detect and respond to a wide range of security threats, including malware, phishing, insider threats, and zero-day attacks. Chronicle Sec Ops threat detection and response capabilities automatically find threats at unparalleled speed and scale in real-time utilizing Google-Core infrastructure, curated and/or custom detection techniques, and telemetry from security and environment IT telemetry. The Chronicle Sec Ops rules engine used in the threat detection process includes predefined rules mapped to specific threats, suspicious activity, and security frameworks like MITRE ATT&CK. The rules engine syntax is built using the widely adopted YARA detection language (xxxxx://xxxxx.xxxxxx.xxx/chronicle/docs/detection/yara-l-2-0-syntax) allowing organizations to easily adjust or extend rules to meet their enterprise’s specific needs. Chronicle Sec Ops allows you to interrogate all your security telemetry in one place so that you can accurately identify threats and reach decisions faster than ever. The solution includes 500+ YARA-L based SOC Prime rules (xxxxx://xxxxxx.xxx/chronicle/detection-rules) and a Sigma to YARA-L converter so organizations can easily port or migrate existing rules from legacy systems to Chronicle. Once Chronicle Sec Ops detects a threat within the environment, organizations can leverage our purpose-built integrations with Chronicle SOAR, (or any of the leading SOAR vendors), allowing organizations flexibility to combine the real-time threat detection and investigation The State of Florida Department of Management Services May 2023 capabilities of Chronicle Sec Ops with your SOAR playbooks as they simplify and mature their detection and response efforts. Lastly, Chronicle leverages IOC matching (both in-line and retrospectively as soon as the threat intel is ingested and parsed by the Chronicle ingestion api). Chronicle ingests threat intel sources from Mandiant Advantage Threat Intel (MATI), VirusTotal (VT), and other sources of threat intel from providers ranging from TIP (Threat Intelligence Platforms), other premium 3rd party TI, ISAC TI, open-source TI and more.
