CoreQ Academy4.1 Given a scenario, analyze data to enable monitoring and response activities.
Monitoring at enterprise scale is a data problem: get the right sources, parse them correctly, correlate them and alert on what matters, with metrics that show it works.
Security information event management (SIEM)
- Event parsing
- Extracting fields from raw logs; broken parsers silently hide events.
- Event duplication
- Duplicate events inflate volume and skew correlation; deduplicate at ingestion.
- Non-reporting devices
- Sources that stop sending logs; alert on silence.
- Retention
- Keeping data long enough for investigations and compliance.
- Event false positives/false negatives
- Tune rules to reduce noise without missing attacks.
Aggregate data analysis
- Correlation
- Linking related events across sources to reveal attacks.
- Audit log reduction
- Filtering and summarising high-volume logs to keep what has security value.
- Prioritization
- Ranking events by risk.
- Trends
- Changes over time that reveal slow attacks or improving posture.
Behavior baselines and analytics
- Network
- Normal traffic volumes, destinations and protocols.
- Systems
- Normal processes, services and resource use.
- Users
- Normal login times, locations and data access.
- Applications/services
- Normal request rates, errors and behaviour.
Incorporating diverse data sources
- Third-party reports and logs
- Vendor and MSSP data about your environment.
- Threat intelligence feeds
- Indicators and context about current threats.
- Vulnerability scans
- Which assets are exposed to which weaknesses.
- CVE details
- Specifics of vulnerabilities seen in alerts.
- Bounty programs
- Reports from external researchers.
- DLP data
- Alerts about sensitive data movement.
- Endpoint logs
- Process, file and network activity from hosts.
- Infrastructure device logs
- Firewalls, routers, switches, load balancers.
- Application logs
- Authentication, errors and transactions.
- Cloud security posture management (CSPM) data
- Misconfiguration findings across cloud accounts.
Alerting
- False positives/false negatives
- Measure and tune alert accuracy.
- Alert failures
- Alerts that do not fire or do not reach anyone; test alert paths.
- Prioritization factors
- What decides which alert is handled first.
- Criticality
- How essential the affected asset is.
- Impact
- Potential damage if the alert is real.
- Asset type
- Domain controller vs. kiosk, production vs. test.
- Residual risk
- Risk remaining after existing controls.
- Data classification
- Sensitivity of data involved.
- Malware
- Alerts involving confirmed malware get higher priority.
- Vulnerabilities
- Alerts on assets with known exploitable vulnerabilities are more urgent.
Reporting and metrics
- Visualization
- Charts that make patterns obvious.
- Dashboards
- Live views of key security metrics for each audience.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.1 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.