Security Operations · Topic 9 of 14
Monitoring Tools and Protocols
Security+ monitoring tools: benchmarks, agents, scanners, packet analyzers, NetFlow, SNMP, syslog, SCAP, port mirroring and network management systems.
- 5 min
- Benchmarks give the settings to check against. SCAP checks them automatically.
- Agents give deep detail but need installing. Agentless needs nothing installed but sees less.
- A packet analyzer shows full content. NetFlow shows summaries only.
What it is
Monitoring depends on tools that collect data and protocols that move it. This page covers the monitoring tools, the protocols NetFlow, the Simple Network Management Protocol (SNMP), syslog and the Security Content Automation Protocol (SCAP), port mirroring and network management systems.
The exam often describes what a tool shows and asks you to name it, so learn what each one sees and what it does not.
How it works
Monitoring tools
| Tool | What it does |
|---|---|
| Benchmarks | Recommended secure settings per product, such as Center for Internet Security (CIS) benchmarks, used as a reference for compliance checks |
| Agents | Software installed on the device that collects detailed data and can act locally |
| Agentless | Data collected over the network or through an interface, with nothing installed on the device |
| SIEM | Aggregates and correlates logs from all the other tools |
| Antivirus | Detects and blocks known malicious software and reports detections |
| Data loss prevention (DLP) | Detects sensitive data leaving the organization and reports or blocks it |
| Vulnerability scanners | Search systems for known flaws and misconfigurations |
| Orchestration | Connects tools so that alerts trigger coordinated, automated steps |
| Packet analyzer | Captures and decodes network traffic so an analyst can read each packet |
Agents and agentless monitoring
| Approach | Strengths | Weaknesses |
|---|---|---|
| Agent | Deep detail, works off the network, can respond on the host | Must be installed, updated and supported on every device |
| Agentless | Nothing to install, quick to roll out, works on devices that cannot run agents | Less detail, depends on network access and credentials |
Printers, network gear and some appliances cannot run agents, so agentless collection is often the only choice for them.
Protocols
| Protocol | What it carries | Notes |
|---|---|---|
| NetFlow | Summary records of network conversations: source, destination, ports, time and volume | No packet content. Internet Protocol Flow Information Export (IPFIX) is the standard based on it |
| SNMP | Device status and statistics, read by a manager from agents on devices | Queries on UDP 161 and traps on UDP 162. Version 3 adds authentication and encryption |
| syslog | Event messages from devices and systems to a central server | Traditionally UDP 514. Each message has a facility and a severity from 0 (emergency) to 7 (debug) |
| SCAP | A suite of standards for expressing and automatically checking security configuration and vulnerabilities | Published by the National Institute of Standards and Technology (NIST). Its parts include CVE and CVSS |
NetFlow is enough to spot unusual patterns such as large uploads, scanning or traffic to unknown countries, without storing everything. An SNMP trap is a message the device sends on its own when an event happens, while normal SNMP polling is the manager asking for values.
SNMP versions 1 and 2c send community strings in clear text, so version 3 is the secure choice. Plain syslog is not encrypted, so it can be sent over Transport Layer Security (TLS) when the path is untrusted.
SCAP lets a scanner check many systems against a benchmark in a standard, machine readable way. The result is a consistent compliance report across products.
Port mirroring
Port mirroring makes a switch copy traffic from one or more ports or virtual local area networks (VLANs) to a monitoring port. An intrusion detection system or packet analyzer connected there sees the traffic without being inline. A network tap is a hardware alternative that copies traffic on a cable.
A busy switch may drop mirrored packets, so mirroring is best for monitoring and investigation rather than a perfect record.
Network management systems
A network management system (NMS) monitors the health of network devices from one console. It polls devices with SNMP, receives traps and syslog messages, maps the topology and alerts when a link or device fails or performance drops. Its data helps security teams too, for example by showing an unexpected configuration change or a new device.
How the exam asks about this
- "Show which hosts talked to which, when and how much, without storing content." -> NetFlow.
- "An analyst needs to read the contents of suspicious packets." -> A packet analyzer, fed by port mirroring or a capture.
- "Automatically check hundreds of servers against a benchmark in a standard format." -> SCAP.
What to remember for the exam
- Benchmarks give the settings to check against. SCAP checks them automatically.
- Agents give deep detail but need installing. Agentless needs nothing installed but sees less.
- A packet analyzer shows full content. NetFlow shows summaries only.
- IPFIX is the standard based on NetFlow.
- SNMP polls on UDP 161 and sends traps on UDP 162. Use version 3.
- syslog sends event messages to a central server, with severities from 0 to 7.
- Port mirroring copies switch traffic to a monitoring port for an IDS or analyzer.
- A network management system watches device health using SNMP, traps and syslog.
When the question says "who talked to whom and how much", the answer is NetFlow. When it says "the actual contents", the answer is a packet capture.
Common mistakes
Expecting NetFlow to show packet content. It records summaries only. Packet capture is needed for the content.
Using old SNMP versions. Versions before 3 send community strings without protection.
Mixing up an SNMP trap and a poll. A trap is sent by the device. A poll is a request from the manager.
Thinking port mirroring blocks traffic. It sends a copy. The monitoring device is not inline.
Assuming agentless covers everything. It sees less detail and needs credentials and network reach.
Packet captures can contain passwords and personal data. Store them securely and keep them only as long as needed.
Check yourself
What information does NetFlow provide?
Metadata about network conversations, such as source, destination, time and volume, without the content.
What does port mirroring do?
It makes a switch copy traffic from chosen ports or VLANs to a monitoring port for analysis.
Why should SNMP version 3 be used?
It adds authentication and encryption, which earlier versions lack.
Topic 9 of 14 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.