This objective focuses on visibility and detection. Prevention tools will eventually fail, so an enterprise must maintain continuous visibility to detect, aggregate, and respond to anomalies in real time.
Here is the breakdown of monitoring concepts, workflows, and tools.
1. Monitoring Computing Resources & Activities
Security teams must monitor the entire technology stack to spot anomalies. This monitoring follows a distinct pipeline from data creation to long-term storage.
- Systems Monitoring: Tracking endpoint and server health, user logins, process execution, and registry changes.
- Applications Monitoring: Reviewing software-specific logs (such as web server access logs or database query logs) to detect application-layer exploitation.
- Infrastructure Monitoring: Watching network traffic, router/switch health, and cloud tenant configurations.
The Security Log Pipeline
- Log Aggregation: The practice of collecting raw event logs from thousands of distributed systems (firewalls, Active Directory, workstations) and consolidating them into a centralized repository.
- Alerting: Automated rules that flag specific log patterns and immediately notify analysts. (e.g., if a system records 50 failed login attempts within 10 seconds, followed by a successful login, generate a “Critical: Potential Brute Force” alert).
- Scanning: Routine, scheduled automated checks (such as vulnerability or configuration compliance scans) running across the infrastructure to identify weaknesses before they are exploited.
- Reporting: Compiling aggregated security metrics into human-readable dashboards or compliance summaries for management and auditors.
- Archiving: Moving older historical log data from expensive, fast-access SIEM storage to cheap, long-term “cold storage” (like AWS Glacier) to satisfy compliance and data retention laws.
Alert Response & Remediation
When an alert fires, security analysts must act swiftly to limit damage and continuously refine their detection rules:
- Quarantine: Isolating an infected system or a malicious file to prevent further damage. For an endpoint, this means programmatically severing its network connection so it cannot spread malware laterally, while keeping it powered on for forensics.
- Alert Tuning: The continuous engineering process of adjusting alerting thresholds to eliminate false positives. If a specific detection rule fires hundreds of harmless alerts a day, analysts “tune” the logic so they don’t suffer from alert fatigue, a dangerous state where critical threats are missed because they are buried in a sea of noise.
2. Infrastructure & Network Monitoring Tools
These protocols and data formats allow administrators to check network health and track how data flows across the wire.
- SNMP Traps (Simple Network Management Protocol): A protocol for monitoring network devices (routers, switches, UPS units). While standard SNMP queries involve a management server requesting a device’s status, an SNMP Trap is an unsolicited, immediate alert sent by the device to the central server when a critical event occurs (e.g., “Interface Gi0/1 down” or “Device overheating”).
- NetFlow: A Cisco-developed network protocol that collects IP traffic statistics and volume data.
- Exam Focus: NetFlow does not capture actual packet payloads. Instead, it captures network metadata, the “phone bill” of the network. It records who talked to whom (Source/Destination IP), when they talked, what port they used, and how much data was sent. This is incredibly powerful for tracking data exfiltration or lateral movement.
3. Enterprise Security Platforms & Architecture
These platforms ingest data and enforce security baselines at scale across the organization.
SIEM (Security Information and Event Management)
The central brain of security operations. A SIEM ingests the massive volume of data gathered during log aggregation, normalizes it, and uses a correlation engine to link seemingly unrelated events across different systems into a single security incident.
- Example: If an internal IP address scans the network (Firewall Log) and a user account modifies a registry key simultaneously (Workstation Log), the SIEM correlates these logs to flag an active attacker.
📋 SCAP & Benchmarks
- SCAP (Security Content Automation Protocol): A suite of open standards for formatting and expressing security data in a standardized way. It allows different security tools from different vendors to automatically measure, score, and evaluate system vulnerabilities and configurations seamlessly.
- Benchmarks: Documented, consensus-based best practices for hardening specific technologies.
- Example: CIS (Center for Internet Security) Benchmarks provide step-by-step technical checklists for securing specific operating systems (like RHEL or Windows Server) or applications.
🛡️ Core Defense Tools
- Agents vs. Agentless: * Agent-Based: Requires a small software footprint permanently installed on every endpoint to monitor activities locally and report back to a central server (e.g., Antivirus or EDR software).
- Agentless: Relies on native, built-in network protocols (such as SSH or WMI) to remotely connect to systems and audit them without installing additional software.
- Antivirus / Next-Gen Antivirus (NGAV): Software installed on endpoints that detects and blocks malicious files. Traditional antivirus relies on signature matching; modern versions use behavioral analysis to spot zero-day malware.
- DLP (Data Loss Prevention): A software solution designed to prevent sensitive or regulated data (such as credit card numbers or Social Security numbers) from leaking outside corporate control.
- Example: If an employee attempts to upload a document containing 5,000 customer records to a personal cloud drive, the network DLP tool blocks the upload and flags the action to security.
- Vulnerability Scanners: Automated tools deployed to proactively scan systems, mapping open ports and auditing software versions against dictionaries of known vulnerabilities (e.g., CVEs) to identify missing security patches.