NIST DE.AE-5: Alert Threshold Management
Alert threshold management is your early warning system for security incidents. Without properly configured thresholds, critical threats go undetected while false alarms waste your team's time. This control ensures your organization establishes and maintains appropriate notification levels across all monitoring systems.
What this means
Alert threshold management requires your organization to define and document the specific conditions and severity levels that trigger security alerts. These thresholds must balance sensitivity—catching real threats—with practicality—avoiding alert fatigue. Thresholds apply across detection tools like SIEMs, intrusion detection systems, and monitoring platforms, and should reflect your organization's risk tolerance and asset criticality.
How to comply
- 1.Define alert thresholds for each monitoring tool and data source (network, endpoint, cloud, application logs)
- 2.Document threshold criteria including event types, severity levels, frequency, and affected systems
- 3.Establish baseline metrics to determine what constitutes normal vs. abnormal activity
- 4.Configure automated alerts to trigger at defined thresholds without manual intervention
- 5.Test thresholds regularly to ensure they detect real threats while minimizing false positives
- 6.Review and adjust thresholds quarterly based on incident trends and operational changes
- 7.Assign clear ownership for threshold management and escalation procedures
Evidence auditors look for
- Alert threshold policy document with defined severity levels and trigger conditions
- SIEM configuration logs showing threshold rules and alert rules
- Monitoring tool settings (firewall, IDS/IPS, endpoint detection) with configured thresholds
- Alert tuning reports documenting false positive rates and adjustments made
- Incident response logs showing alerts that triggered and escalated appropriately
- Threshold review and approval records from past 12 months
- Change management tickets for threshold modifications with business justification
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates alert threshold documentation and tracks threshold changes across your entire monitoring stack, eliminating manual spreadsheets and ensuring audit-ready evidence for DE.AE-5 compliance.
See how GRCWatch handles this control automatically
Start free trial