Federal Modernization Workbook · Book 12
Book 12 — Security Operations & Telemetry
You Can’t Defend What You Can’t See
Why you can’t defend what you can’t see: emitting telemetry from every plane under one evidence contract, turning a log warehouse into detection and response, and feeding vulnerability, patch, posture and data findings into one queue an assessor can verify
This book is part of Release 2.0, the workbook’s baseline edition: it is complete, checked against every other book and approved by the workbook’s editor, and later changes are tracked against Release 2.0. Baseline is not a claim of independent peer review (Status labels). This book replaces the workbook’s three-part SIEM telemetry emission guide and its telemetry specification, and draws on the Security Operations volumes of the Federal Compliance series, which stay in the repository for control-level depth. External claims were checked against primary sources beginning October 21, 2026; each carries a note with its own check date. The replaced pages are kept in the repository’s archive/b12-security-operations/ folder, and their old addresses forward to the chapters that replaced them.
b12-security-operations-bundle.docx: the whole book as one Word document, regenerated on every site deploy.
15-minute presentation (about 13 minutes narrated): the Why / What / Who / How deck is on the Presentations page.
Technical deep dive (about 50 minutes live, 18 narrated): the evidence contract, telemetry to detection, vulnerability, patch and posture, and data protection, in modules on the Presentations page.
Executive briefing (about 30 minutes live, 13 narrated): for the CISO, SOC lead, CIO and authorizing officials: M-26-14, the evidence contract, telemetry through the migration, the SIEM and retention decisions, cost, who runs the queue and accepting the risk of what isn’t seen, with each decision’s owner and timing, on the Presentations page.
Detection and response are only as good as the telemetry that reaches them. A log warehouse isn’t a detection engine: storing everything satisfies nobody’s requirement to analyze it, and the gaps that matter most, a plane that never emitted, a connector that shows green while no data arrives, a log tier that raises no alerts, stay silent until an incident finds them. Book 12 starts from that problem. Telemetry has to be emitted deliberately from every plane, identity, cloud platform, Microsoft 365, endpoints, network and data, under one evidence contract whose join key is authoritative asset identity plus time. Vulnerability, patch, configuration, posture and data-protection findings then land in the same queue, against federal clocks such as BOD 26-04’s remediation timelines and M-26-14’s logging requirements. Detections need rules, rules need response, and both need evidence an assessor can verify. And remediation has no substitute: a finding closes only when the thing is fixed, with proof.
Why, what, who, how
| Question | Chapters | |
|---|---|---|
| Why | Why can’t you defend what you can’t see, and why is the evidence contract the precondition? | 01, 02 |
| What | What each plane must emit, how a SIEM and XDR turn logs into detection, and how vulnerability, patch, configuration, posture and data protection feed the queue | 03, 04, 05, 06, 07, 08, 09 |
| Who | Who runs security operations, who owns each plane, detection and playbook, and who accepts residual risk | 10 |
| How | Engineer detections and automate response within the actuation ladder, then evidence the whole system with continuous monitoring and metrics | 11, 12 |
Appendices: A — Requirements mapping: controls, mandates and books; B — Identity and application detections for Zero Trust findings
Reading paths
- Executives (20 minutes): Chapters 01, 10 and 12, or the 15-minute presentation.
- SOC and detection engineers: Chapters 02, 05 and 11, then 03 and 04.
- Platform and cloud engineers: Chapters 03, 04, 07 and 08.
- Vulnerability and patch teams: Chapters 06 and 07.
- Data protection and records: Chapters 09 and 12.
- ISSOs and authorizing officials: Chapters 01, 10 and 12, with Appendix A.
Where this book sits in the workbook
This is Book 12 of the Federal Modernization Workbook. The identity and access signals it collects are designed in Book 02 and Book 04, the devices and servers that emit them in Book 05, DNS logging and Protective DNS in Book 08, CISA telemetry continuity at the network edge in Book 09, Chapter 03, feature availability by government cloud in Book 10, and SCuBA assessment evidence in Book 11. For control-level depth, the Federal Compliance Security Operations volumes remain in the repository.
New and revised procedures in this book follow the workbook’s implementation conventions (control states, the How-section template, authority labels, the evidence checklist, change safety and the Zero Trust mapping block), defined once in Book 00, Appendix D.
Chapters
| Title | Description |
|---|---|
| Chapter 01 — You Can’t Defend What You Can’t See | Why visibility is the precondition for defense: the difference between storing logs and detecting with them, the six planes that must emit telemetry, why coverage gaps never raise an alarm on their own, and what OMB M-26-14, BOD 25-01, BOD 23-01 and CISA’s log warehouse actually ask of an agency. |
| Chapter 02 — Telemetry Is the Precondition: The Evidence Contract | The one evidence contract every source emits into: its fields and what AU-3 requires of them, the join key of authoritative asset identity plus time behind AU-12(1), how vulnerability, patch, posture and data-protection findings land in one queue, the continuous-monitoring pipeline CA-7 describes, and why the naming plane has to exist first. |
| Chapter 03 — Identity Telemetry from Entra ID | How to emit Microsoft Entra ID audit, sign-in, provisioning, Graph activity and ID Protection logs through diagnostic settings: which categories to enable and why, the Log Analytics table each lands in, deploying the setting by portal, tenant-scope Bicep or az rest, retention that satisfies the logging baseline, sovereign-cloud endpoints, and Microsoft Graph as targeted evidence rather than the feed. |
| Chapter 04 — Azure Platform and Microsoft 365 Audit Telemetry | How to emit the Azure activity log and resource logs, why resource-specific tables beat AzureDiagnostics, how Azure Policy keeps new resources from being born silent and where DeployIfNotExists stops, and how to verify, collect and retain the Microsoft 365 unified audit log through the Office 365 Management Activity API, including its timing and ordering rules, GCC endpoints and the license-dependent retention tiers. |
| Chapter 05 — From Log Warehouse to Detection: SIEM and XDR | Why a log store does not satisfy AU-6, what turns collected telemetry into detections an assessor can trace, how Microsoft Sentinel’s connectors land Entra ID, Defender XDR, DNS and DDI, SASE and SQL audit data, how to prove each connector is still delivering, and what Defender XDR contributes. |
| Chapter 06 — Vulnerability Management | Why a scan report and a patch policy don’t answer an assessor; what RA-5 and SI-2 ask for; how CISA BOD 26-04 replaced BOD 22-01 and BOD 19-02 with a four-factor remediation clock tied to the KEV catalog; how Defender Vulnerability Management reaches Arc-enabled servers; how to verify onboarding coverage; how to build a daily, deadline-bearing finding queue; and where the scanner’s job ends and remediation begins. |
| Chapter 07 — Patch, Configuration and Hardening Baselines | How flaw remediation and configuration state are closed across every platform an agency runs: the shared-responsibility line as the SI-2 scoping rule, platform-native actuation under unified governance, CM-8 as the precondition for SI-2, configuration state as the other half of remediation, the cross-cloud overlay decision, the baseline lifecycle with Azure machine configuration and a drift export, the boundary treatment of management agents, and why remediation has no substitute. |
| Chapter 08 — Cloud-Native Posture | Why host scanning misses the risks that live in the cloud control plane and the container layer, how cloud security posture management supports CM-6 for cloud resources, how the program chooses a posture tool per platform across a multi-cloud estate, what a cloud-native application protection platform’s overlapping views add, how Kubernetes admission control and runtime detection support CM-7 and SI-3, and how posture findings reach the evidence contract and line up with FedRAMP’s 2026 Key Security Indicators. |
| Chapter 09 — Data Protection and Classification | Why network and identity controls can’t tell a press release from a Privacy Act record, what the federal CUI framework in 32 CFR Part 2002 actually defines, how the program maps CUI Basic and CUI Specified to Microsoft Purview sensitivity labels and deploys the taxonomy as code, how DLP enforces label-derived signal on the service, the endpoint and the network, how customer-managed keys, BYOK and Double Key Encryption differ, and why a CASB alone can’t close the payload gap. |
| Chapter 10 — Who Runs Security Operations | Who decides, who does the work and who is consulted across security operations: the CIO, the CISO, the authorizing official, system owners and ISSOs, the top-level SOC, security engineering, the platform owner for each telemetry plane, the records, privacy and legal offices, and control assessors; who decides what is collected and how long it is kept, who owns each detection and playbook, and who accepts the risk of what is not seen, with a responsibility matrix consistent with Books 00 and 01. |
| Chapter 11 — Detection Engineering and Response Automation | How the program builds and keeps a detection rule library inside its own authorization boundary, manages it as code through a tested lifecycle, and turns firings into bounded response: a confidence-gated response ladder on Book 01’s actuation rungs, playbooks for session revocation, account and device containment, approval gates, an incident response plan an assessor can test, and the limits of all of it. |
| Chapter 12 — Evidence, Metrics and Continuous Monitoring | How security operations proves itself: CA-7 and the RMF Monitor step, the continuous-monitoring pipeline from emission to plan of action and milestones, what an assessor verifies, a metric set built on M-26-14’s maturity model (inventory and collection coverage, telemetry completeness, detection coverage, retention, MTTD and MTTR, KEV remediation within BOD 26-04 timelines), how ScubaGear evidence and TIC’s automated validation fit, and what FedRAMP’s 2026 Key Security Indicators do and don’t ask of an agency. |
| Appendix A — Requirements Mapping: Controls, Mandates and Books | A compliance-enabling map, not a compliance claim: the NIST SP 800-53 Rev. 5 controls security operations asserts (AU, CA-7, CM-6/7/8, RA-5, SI-2/3/4, IR-4/5, SC-7), with their NIST and FedRAMP baselines, and the mandates behind them (OMB M-26-14, BOD 26-04 and the KEV catalog, BOD 23-01, BOD 25-01, TIC 3.0, CISA incident notification, FedRAMP’s 2026 rules, NIST’s RMF and continuous monitoring guidance), each mapped to the Book 12 chapter that carries it and to the other workbook books; then the requirements that are cited but don’t say what is claimed, and the sources. |
| Appendix B — Identity and Application Detections for Zero Trust Findings | The detections a Zero Trust assessment’s identity and application findings need behind them, as a rule pack for the library in Chapter 11: emergency access use and change, privileged activation, administrator password resets, authentication method changes, tenant creation, federation changes, device code flow, risky users and sign-ins, then new application credentials, owner changes, consent, high-privilege grants, service principal role assignments and risk, and redirect URI changes. Each with its KQL from Microsoft Learn or Microsoft’s published rule templates, its data source and its availability in GCC, GCC High and DoD; then the How-section steps, the synthetic tests that prove each rule fires, the evidence an assessor reads and who runs it on day two. |
Version and revision history
Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.
| Version | Edition | Date | Changes |
|---|---|---|---|
| 2.0 | 2026.11.5 | 2026-11-08 | Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Edition 2026.11.4: record the edition and point deck links at it (#362); Book 12: fix confirmed crosswalk errors (risk acceptance split, PaaS guest OS, deployment order, appendix scope, references) (#400); Apply the open-choice decisions: text, plans, training, reference, register (#416); External Partner Person: light edits to existing pages, held findings, links (E0 to E9) (#419); Book 12: align inconsistent numbers, terms, titles and cross-references (22 findings) (#434); Decisions pass, Books 05-12: apply Mike’s calls and take-the-recommendation items (#453); Nov 8 fixes: Start Here about 7 minutes; BOD 25-01 reporting methods per CISA; EO 14144 4(c) in Book 08; SP access review stage (#466); and 6 more (all changes) |
| 1.5 | 2026.11.4 | 2026-11-05 | Approve ten pages on Mike’s word, and drop two names from the briefs (#360); Sweep stale wording, and link sources on every deck (#361) |
| 1.4 | 2026.11.3 | 2026-11-05 | Book decks: narration names the book or the original source, and 68 videos re-exported (#344) |
| 1.3 | 2026.11.2 | 2026-11-02 | Privacy for workforce identity: Book 03 Chapter 14, and privacy sections in six books (#317) |
| 1.2 | 2026.11.1 | 2026-11-01 | Edition 2026.11: record the edition, and publish the four gate-level decks and videos (#282) |
| 1.1 | 2026.11 | 2026-11-01 | Move the decks and narration audio out of git, onto edition 2026.10 (#260) |
| 1.0 | 2026.10 | 2026-10-31 | First edition (20 merged changes since the book began) |