*Develop reporting logic and work with security operations staff to configure how often, what information, and what priorities are sent from monitoring tool alerts. (Task ID: R2-9157)

*Develop standard communication procedure to use when writing rules (Task ID: R2-9580)

*Establish baselines for setting incident alert levels in SIEM systems and periodically review and adjust the levels to ensure optimal monitoring (Task ID: R2-9587)

*Identify normal communication behavior (Task ID: R2-9584)

*Test system for performing according to desired functionality and configured policies (Task ID: R2-9582)

*Verify configuration alert types and alerts are working (Task ID: R2-9583)

*Coordinate periodic testing of Alerting mechanisms to ensure the methodology is functioning as expected. (Task ID: R2-9585)

*Develop baseline scanning as a part of Configuration Management policies and procedures. (Task ID: R2-9280)

*Develop custom internal network monitoring tools (non vendor solution) to detect anomalies that vendor tools would not be able to identify. (Task ID: R2-9161)

*Develop custom scan rules to provide deeper scans or avoid problematic checks. (Task ID: R2-9288)

*Develop management interface view to maintain situational awareness of the monitoring tools or agents health and operating conditions. (Task ID: R2-9163)

*identify metrics by which tools will be measured against to ensure it's still meeting requirements and goals (Task ID: R2-9258)

*Implement intrusion prevention/detection solution (Task ID: R2-9149)

*Implement secondary scanner should the initial scanner experience usage issues (Task ID: R2-9289)