Security Operations and Incident Response · Topic 2 of 4
Security Operations
Logging and monitoring, SIEM and AI-assisted triage, false positives and negatives, threat actors and motivations, threat intelligence and threat frameworks.
- 3 min
- Centralize logs, sync clocks, log important events.
- SIEM collects and correlates; ML helps find anomalies.
- False negatives are the most dangerous alert outcome.
What it is
Security operations watch systems for signs of attack and decide which events need action. Teams, often in a security operations center (SOC), collect logs, triage alerts, learn about threats and use frameworks that describe how attackers work.
How it works
Logging and monitoring
- Log important events: sign-ins, privilege use, configuration changes, access to sensitive data.
- Send logs to a central place so attackers cannot easily delete them.
- Keep clocks synchronized so events from different systems line up.
- A SIEM (security information and event management) collects and correlates logs and raises alerts.
- Machine learning in a SIEM helps spot unusual activity across very large volumes of logs and reduce alert fatigue.
Alert outcomes
| Outcome | Meaning |
|---|---|
| True positive | Alert on a real attack |
| False positive | Alert on harmless activity |
| True negative | No alert, and nothing was wrong |
| False negative | A real attack with no alert; the most dangerous outcome |
Security event triage
Triage decides which events matter most:
- Use cases define what to watch for, such as many failed logins followed by a success.
- Prioritization ranks alerts by the importance of the affected asset and how likely the alert is real.
- Correlation links related events from different sources into one picture.
AI-assisted triage tools can suggest priorities and actions, but people stay in charge: an AI proposal to isolate a business-critical server is weighed with the system owner under the incident response plan.
Routine automated blocks (for example a firewall dropping known bad traffic) usually need no human action. Events showing possible success, such as an unusual login followed by data access, need investigation.
Threat actors and motivations
| Actor | Typical motivation |
|---|---|
| Cybercriminals | Money: ransomware, fraud, data theft |
| Nation-state groups | Espionage, disruption, strategic advantage |
| Hacktivists | Political or social causes |
| Insiders | Grievance, money or carelessness |
| Script kiddies | Curiosity or reputation, using ready-made tools |
Cyber threat intelligence
Threat intelligence is information about attackers, their methods and indicators of compromise such as malicious IP addresses, domains and file hashes. Sources include sharing groups, vendors and government agencies. Use it to block threats and to search past logs for signs of earlier compromise.
Threat frameworks
| Framework | Purpose |
|---|---|
| MITRE ATT&CK | A knowledge base of attacker tactics and techniques |
| Cyber Kill Chain | The stages of an attack, from reconnaissance to actions on objectives |
These frameworks help teams describe attacks consistently and find gaps in detection.
How the exam asks about this
- "The SIEM recorded an attack but raised no alert." A false negative.
- "Which task does machine learning in a SIEM improve?" Spotting unusual activity across many logs.
- "Which framework catalogs attacker tactics and techniques?" MITRE ATT&CK.
What to remember for the exam
- Centralize logs, sync clocks, log important events.
- SIEM collects and correlates; ML helps find anomalies.
- False negatives are the most dangerous alert outcome.
- Triage uses use cases, prioritization and correlation.
- Know the main threat actor types and their motivations, and MITRE ATT&CK and the Cyber Kill Chain.
Logs that nobody reviews do not detect anything. Monitoring must be an active process.
Common mistakes
Confusing false positives with false negatives.
Letting an AI tool act on critical systems without human judgment.
Logging only on the local system.
Check yourself
What is a false positive?
An alert raised for harmless activity.
What motivates most cybercriminals?
Money.
What is an indicator of compromise?
Evidence such as a malicious IP address, domain or file hash that suggests an attack.
Topic 2 of 4 in Security Operations and Incident Response
Test yourself on Security Operations and Incident Response
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.