Security Operations · Topic 8 of 14
Security Monitoring and Alerting
Security+ monitoring and alerting: systems, applications and infrastructure, log aggregation, SIEM, automated alerts, dashboards and alert tuning.
- 5 min
- Includes a diagram
- Monitoring covers systems, applications and infrastructure.
- The activities are log aggregation, alerting, scanning, archiving, reporting and alert tuning.
- A SIEM aggregates, normalizes and correlates logs, then alerts and reports.
What it is
Monitoring means watching systems, applications and infrastructure for signs of trouble. Alerting means notifying the right people when something needs attention.
Raw data from thousands of devices is useless unless it is collected, correlated and turned into clear alerts. This page covers what is monitored, the monitoring activities, the security information and event management (SIEM) system, automated alerts and dashboards.
How it works
Monitoring computing resources
| Resource | What is watched |
|---|---|
| Systems | Servers and workstations: logins, privilege use, processes, services, resource use and security events |
| Applications | Errors, authentication events, input failures, administrative actions and response times |
| Infrastructure | Network devices, firewalls, storage, virtualization and cloud services: status, traffic, configuration changes and failures |
Each layer shows a different part of an attack. A login on a server, an error spike in an application and an unusual flow through a firewall may all belong to the same incident.
Monitoring activities
| Activity | Purpose |
|---|---|
| Log aggregation | Collect logs from many sources in one place |
| Alerting | Notify staff when rules or thresholds are met |
| Scanning | Look for vulnerabilities, misconfigurations and unauthorized devices |
| Archiving | Store logs for the required retention period |
| Reporting | Summarize activity, trends and compliance for staff and managers |
| Alert tuning | Adjust rules to reduce noise and keep real detections |
Archived logs support later investigations and compliance. They should be protected from change, since logs are valuable evidence.
Security information and event management
A SIEM collects logs from many sources, normalizes them into a common format and correlates events to find patterns that a single log would not show. For example, a failed login on a server, followed by a successful login from a new country and a large data transfer, may be one story across three logs.
A SIEM provides search, correlation rules, alerts, dashboards and reports. It depends on accurate time stamps, so systems should synchronize their clocks with a common time source.
Automated alerts
Automated alerts fire when a rule, threshold or anomaly is detected, without a person watching a screen. Good alerts include what happened, where, how serious it is and what to check first.
| Alert type | Example |
|---|---|
| Threshold | More than a set number of failed logins in five minutes |
| Correlation | A login from a new country followed by mass file access |
| Anomaly | Traffic far above the normal pattern for a server |
| Status | A security agent stopped reporting |
Alerts can also start automated actions, such as opening a ticket or running a response playbook.
Dashboards
A dashboard is a live visual summary of key measures, such as open alerts by severity, failed logins, top talkers on the network or patch status. It helps analysts see trends at a glance and helps managers follow progress. A dashboard shows the overall picture, and the analyst then drills down into the detailed logs.
Alert tuning and false results
Too many alerts cause alert fatigue, where analysts miss real incidents among the noise. Tuning adjusts thresholds and rules, adds exceptions for known good activity and removes duplicate alerts.
| Result | Meaning |
|---|---|
| True positive | A real attack was alerted |
| False positive | An alert fired for normal activity |
| False negative | A real attack produced no alert |
| True negative | Normal activity correctly produced no alert |
Too much tuning can create false negatives, so each change should be tested and recorded.
How the exam asks about this
- "Correlate events from firewalls, servers and applications to find one attack." -> A SIEM.
- "Analysts ignore alerts because most are noise." -> Alert tuning to cut false positives.
- "Managers want a live view of open alerts by severity." -> A dashboard.
What to remember for the exam
- Monitoring covers systems, applications and infrastructure.
- The activities are log aggregation, alerting, scanning, archiving, reporting and alert tuning.
- A SIEM aggregates, normalizes and correlates logs, then alerts and reports.
- Accurate, synchronized time is needed so that events from different systems line up.
- Automated alerts fire on thresholds, correlations, anomalies or status changes.
- Dashboards give a live summary, and analysts drill down from there.
- Alert tuning reduces false positives, but must be tested so that real detections are not lost.
- Archived logs should be protected, as they can serve as evidence.
When the question says "correlate events from many systems", the answer is a SIEM. When it says "too many alerts, real ones missed", the answer is alert tuning.
Common mistakes
Believing more alerts mean better security. Excess noise hides real incidents. Tuning is part of good monitoring.
Forgetting time synchronization. Logs with different clocks cannot be lined up reliably.
Watching only servers. Applications and infrastructure show parts of an attack that system logs miss.
Treating a dashboard as the investigation. It shows a summary. The evidence is in the detailed logs.
Letting attackers erase the evidence. Logs kept only on the source device can be removed, so send copies to a central store.
Tuning out an alert to cut noise can hide a real attack. Review each tuning change and keep a record of why it was made.
Check yourself
What does a SIEM do that a single log file cannot?
It collects logs from many sources and correlates them to reveal patterns across systems.
What is alert fatigue?
When analysts receive so many alerts, mostly noise, that real incidents are missed.
What is a false negative?
A real attack that produced no alert.
Topic 8 of 14 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.