Alerting and Monitoring
Explain security alerting and monitoring concepts and tools
What you will learn
- Explain the monitoring cycle from aggregation to response and archiving.
- Know what a SIEM does and why deploying one is not the same as tuning one.
- Distinguish the tools: SIEM, DLP, SNMP, NetFlow, and agent versus agentless.
- Explain alert fatigue and its real effect on detection.
Monitoring is a detective control, not a preventive one: it stops no attack, but it decides how long one runs before discovery — and that time is usually what decides the damage. The practical problem is not too little data: a mid-sized environment produces millions of lines a day, and the question is how the one that matters surfaces.
The monitoring cycle
Aggregation
Collecting logs in one place. A log left on the compromised host can be wiped in the attacker's first clean-up.
Correlation and alerting
Linking events across sources: a failed login, then a success, then an admin privilege — three ordinary lines that together make an alarm.
Response
Human triage or an automated action: isolate a host, disable an account.
Archiving
Retaining for the mandated period. An investigation may begin months after the event.
The tools
| SIEM | Collects, correlates and alerts. Deploying one is easy; tuning it is the real work — untuned, it becomes a noise generator. |
|---|---|
| DLP | Data loss prevention: watches data leaving and blocks what matches a rule — a card number in an email, for instance. |
| NetFlow | Metadata about network sessions: who talked to whom, how much, when. It holds no content and is far smaller. |
| SNMP traps | Alerts network devices send when an event occurs. |
| Agent vs agentless | An agent is installed on the host, sees deeper and needs maintenance; agentless is lighter and sees less. |
| SCAP / benchmarks | Machine-readable standards for measuring configuration conformance against a baseline. |
Alert fatigue blinds; it does not merely annoy
An untuned SIEM sends thousands of alerts a day, most of them false positives, and analysts learn to close them fast — so when the real one arrives it is closed with them. The problem is not the tool but its tuning. If a question says a team is ignoring alerts, the answer is tuning the rules and reducing noise, not buying another tool or hiring more analysts.
Real-world example: three ordinary lines
At 02:41 an admin account fails to log in — that happens daily. At 02:42 the same account succeeds — normal, they mistyped it. At 02:44 a new admin account is created — administrators do that. No line alone deserves an alert; the three together within three minutes from an external address mean a compromise. That is correlation: a SIEM's value is not in collecting logs but in seeing what no single log shows.
What matters on the exam
- Monitoring is detective, not preventive. If the question asks about prevention, it is not the answer.
- Central log aggregation protects the evidence from the attacker. A local log is wiped with the host.
- "Too many alerts, all ignored" = tune the rules. Not a new tool and not a bigger team.
- NetFlow is metadata without content — it answers "who talked to whom", not "what they said".
Quick check
Answer in your head first, then reveal.
Why are logs collected to a central server instead of left on the hosts?Reveal the answer
Two reasons: correlation across sources is only possible centrally, and evidence protection — the first thing a capable attacker does is wipe the log on the host they compromised.
A security team is ignoring SIEM alerts. What is the fix?Reveal the answer
Tune the rules to cut false positives and prioritise alerts. The problem is alert fatigue, not missing tooling — and adding another tool increases the noise.
What separates agent-based from agentless monitoring?Reveal the answer
An agent is installed on the host, sees processes and files, and works even off the network — at the price of deployment and maintenance. Agentless collects remotely, sees less, and needs nothing installed.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.