CoreQ Academy4.4 Explain security alerting and monitoring concepts and tools.
Monitoring turns raw events into decisions. Collect the right logs, centralise them, alert on what matters, tune out noise and respond.
Monitoring computing resources
- Systems
- Servers and endpoints: logins, processes, resource use.
- Applications
- Errors, authentication events, unusual transactions.
- Infrastructure
- Network devices, cloud control planes, storage.
Activities
- Log aggregation
- Collecting logs from many sources into one place with consistent timestamps.
- Alerting
- Notifying people or systems when a rule or anomaly fires.
- Scanning
- Regularly checking systems for vulnerabilities and misconfigurations.
- Reporting
- Summaries for operations, management and compliance.
- Archiving
- Keeping logs for the required retention period, protected from tampering.
- Alert response and remediation/validation
- Triage, investigate, fix and confirm.
- Quarantine
- Isolating a suspicious file or host so it cannot cause more harm.
- Alert tuning
- Adjusting rules to cut false positives without missing real attacks.
Tools
- Security Content Automation Protocol (SCAP)
- A set of standards for expressing and checking security configuration and vulnerabilities automatically.
- Benchmarks
- Published secure configuration standards, such as CIS Benchmarks.
- Agents/agentless
- Agents are installed on hosts for deep visibility; agentless monitoring uses remote protocols or APIs.
- Security information and event management (SIEM)
- Central platform that aggregates, correlates and alerts on log data.
- Antivirus
- Detects and removes known malware, increasingly with behaviour analysis.
- Data loss prevention (DLP)
- Detects and blocks sensitive data leaving through email, web, USB or cloud.
- Simple Network Management Protocol (SNMP) traps
- Alerts that network devices push to a management server when an event occurs. Use SNMPv3 for security.
- NetFlow
- Records metadata about network flows (who talked to whom, how much, when) without full packet content.
- Vulnerability scanners
- Tools that identify known weaknesses across systems.
Check your understanding
Knowledge quiz · pass mark 80%
- DLP can block an email that contains customer card numbers.
- Which tool correlates logs from many sources and raises alerts?
- Which shows who talked to whom and how much data, without full packets?
- Reducing noisy alerts that fire on normal behaviour is:
Original CoreQ Academy material, mapped to objective 4.4 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.