The organization shall review and analyze detected events to understand attack targets and methods.
The organization shall implement automated mechanisms where feasible to review and analyze detected events.