Alerting and monitoring
Exam objective 4.4: Explain security alerting and monitoring concepts and tools.
On this page
Monitoring turns raw events into alerts that people can act on. The objective covers what to monitor, the activities (log aggregation, alerting, scanning, reporting, archiving, alert response and tuning), and the tools: SCAP, benchmarks, agents, SIEM, antivirus, DLP, SNMP traps, NetFlow, and vulnerability scanners.
Activities
Monitor systems, applications, and infrastructure. Log aggregation collects logs in one place; alerting raises notifications on rules; reporting summarizes; archiving keeps logs for investigations and compliance. Alert tuning adjusts rules to reduce false positives without hiding real attacks. Quarantine isolates suspicious files or hosts as part of the response.
Tools
| Tool | Purpose |
|---|---|
| SIEM | Collects, correlates, and alerts on logs from many sources |
| SCAP | Standard formats for automated configuration and vulnerability checks |
| Benchmarks | Hardening standards such as CIS benchmarks |
| Agent / agentless | Software on a host vs. remote collection |
| DLP | Detects and blocks sensitive data leaving |
| SNMP traps | Devices push alerts to a manager |
| NetFlow | Summaries of who talked to whom, when, and how much |
| Antivirus | Detects known malware on endpoints |
Key terms
- Security information and event management (SIEM)
- A system that aggregates and correlates logs from many sources and raises alerts.
- Log aggregation
- Collecting logs from many systems into a central location.
- Alert tuning
- Adjusting detection rules to cut false positives while still catching real threats.
- Security Content Automation Protocol (SCAP)
- A set of standards for automating configuration checks and vulnerability assessment.
- Data loss prevention (DLP)
- Tools that detect and block sensitive data from leaving through email, web, or devices.
- SNMP trap
- An unsolicited alert a network device sends to a management station when an event occurs.
- NetFlow
- A protocol that records metadata about network flows, such as source, destination, and volume.
- Agent-based monitoring
- Collecting data with software installed on each monitored host.
- Archiving
- Storing logs and records long term for investigations and compliance.
- Quarantine
- Isolating a suspicious file or device so it can't cause harm while it's investigated.
Check yourself
20 practice questions on this objective
Practice this objectiveFlashcards for this objective