Security Operations · Topic 6 of 13
Security Monitoring and Alerting
Security+ monitoring and alerting: log aggregation, SIEM correlation, NetFlow, SNMP, SCAP, benchmarks, agents, alert tuning, quarantine and reporting.
- 4 min
- Includes a diagram
- Log aggregation collects logs in one place, and a SIEM correlates them to find patterns.
- Accurate time (through NTP) is needed so that events from different systems line up.
- NetFlow records metadata about traffic flows, not the content.
What it is
Monitoring means watching systems, applications and networks for signs of trouble. Alerting means notifying the right people when something needs attention.
Raw data from thousands of devices is useless unless it is collected, correlated and turned into clear alerts. This page covers the activities and tools that do that.
How it works
Monitoring activities
| Activity | Purpose |
|---|---|
| Log aggregation | Collect logs from many sources in one place |
| Alerting | Notify staff when rules or thresholds are met |
| Scanning | Look for vulnerabilities and unauthorized devices |
| Reporting | Summarize activity for staff and managers |
| Archiving | Store logs for the required retention period |
| Alert response | Triage the alert, investigate and act |
| Quarantine | Isolate a suspect device or file |
| Alert tuning | Adjust rules to reduce noise and keep real detections |
Archived logs support later investigations and compliance. They should be protected from change, since logs are valuable evidence.
Security information and event management
A security information and event management (SIEM) system collects logs from many sources, normalizes them and correlates events to find patterns that a single log would not show. For example, a failed login on a server followed by a successful login from a new country and a large data transfer may be one story across three logs.
A SIEM provides dashboards, alerts, search and reporting. It depends on accurate time stamps, so systems should synchronize their clocks with Network Time Protocol (NTP).
Tools and data sources
| Tool | What it does |
|---|---|
| Security Content Automation Protocol (SCAP) | A standard way to express and check security settings and vulnerabilities |
| Benchmarks | Recommended settings used as a reference for compliance checks |
| Agents and agentless monitoring | Software on the device, or collection over the network without installed software |
| Antivirus and anti malware | Detect and block known malicious software |
| Data loss prevention (DLP) | Detects sensitive data leaving the organization |
| Simple Network Management Protocol (SNMP) traps | Messages sent by a device to report an event |
| NetFlow | Summary records of network conversations: who talked to whom, when and how much |
| Vulnerability scanners | Search systems for known flaws |
NetFlow does not capture the content of traffic. It records metadata, which is enough to spot unusual patterns such as large uploads or scanning behavior.
Alert tuning and false results
Too many alerts cause alert fatigue, where analysts miss real incidents among the noise. Tuning adjusts thresholds and rules, and it helps to separate false positives from true detections. Too much tuning can create false negatives, so changes should be tested.
Protocol versions
SNMP version 3 adds authentication and encryption. Earlier versions send community strings in clear text, so version 3 is the secure choice.
What to remember for the exam
- Log aggregation collects logs in one place, and a SIEM correlates them to find patterns.
- Accurate time (through NTP) is needed so that events from different systems line up.
- NetFlow records metadata about traffic flows, not the content.
- SNMP version 3 is the secure version.
- SCAP and benchmarks help check configuration against a standard.
- Alert tuning reduces false positives, but must be tested so real detections are not lost.
- Quarantine isolates a suspect device or file.
- Archived logs should be protected, as they can serve as evidence.
When the question says "correlate events from many systems", the answer is a SIEM. When it says "who talked to whom and how much", the answer is NetFlow.
Common mistakes
Believing more alerts mean better security. Excess noise hides real incidents. Tuning is part of good monitoring.
Forgetting time synchronization. Logs with different clocks cannot be lined up reliably.
Expecting NetFlow to show packet content. It records summaries only. Packet capture is needed for the content.
Using old SNMP versions. Versions before 3 send credentials without protection.
Letting attackers erase the evidence. Logs kept only on the source device can be removed, so send copies to a central store.
Tuning out an alert to cut noise can hide a real attack. Review each tuning change and keep a record of why it was made.
Check yourself
What does a SIEM do that a single log file cannot?
It collects logs from many sources and correlates them to reveal patterns across systems.
What information does NetFlow provide?
Metadata about network conversations, such as source, destination, time and volume, without the content.
Why should SNMP version 3 be used?
It adds authentication and encryption, which earlier versions lack.
Topic 6 of 13 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.