Security Operations · Topic 2 of 9
Logging and Monitoring
Logging and monitoring for CISSP: SIEM, SOAR, continuous monitoring, egress monitoring, log management, threat intelligence, UEBA and threat hunting.
- 3 min
- Log the right events, sync clocks, centralize, protect integrity, retain per policy.
- SIEM correlates; SOAR automates; UEBA finds behavioural anomalies.
- Egress monitoring catches exfiltration.
What it is
Logging records what happens; monitoring watches those records to detect problems. Together they support detection, investigation, accountability and compliance. Logs are only useful if the right events are captured, protected, kept long enough and actually reviewed.
How it works
Log management
| Practice | Why |
|---|---|
| Log the right events (authentication, privilege use, changes, access to sensitive data) | Detection and accountability |
| Synchronize clocks (NTP) | Correlate events across systems |
| Centralize logs | Attackers cannot easily erase them from the source |
| Protect integrity (write-once storage, hashing, restricted access) | Evidence value |
| Reliable transport with buffering | No lost events during peaks |
| Retention per policy and law | Investigations and compliance |
| Monitor that sources keep reporting | Silence can mean failure or tampering |
A log source that goes silent is itself a warning. Heartbeat monitoring alerts when an expected source stops sending events.
Monitoring tools
| Tool | Function |
|---|---|
| SIEM (security information and event management) | Collects, normalizes and correlates events; alerts and supports investigation |
| SOAR (security orchestration, automation and response) | Automates responses with playbooks |
| IDS / IPS | Detects or blocks malicious network or host activity |
| UEBA (user and entity behavior analytics) | Learns normal behaviour and flags anomalies |
| Egress monitoring | Watches outbound traffic for data exfiltration and command-and-control |
| Continuous monitoring | Ongoing assessment of controls and risk rather than point-in-time checks |
Threat intelligence
Threat feeds and sharing groups provide indicators of compromise (hashes, domains, IP addresses) and attacker tactics. Use indicators both to block future activity and to search past logs (retrospective hunting), because attackers who stay hidden for months may already be inside.
Threat hunting
Analysts proactively look for attackers who evaded automated detection, starting from a hypothesis (for example "an attacker uses scheduled tasks for persistence") and searching telemetry.
Making alerts useful
- Tune rules to reduce false positives without blinding detection.
- Prioritize alerts by asset criticality and confidence.
- Document runbooks so different analysts handle the same alert type consistently.
- Measure mean time to detect and respond.
Privacy and policy
Monitoring of staff must follow law and policy. Inform users through policy and banners, and limit access to monitoring data.
How the exam asks about this
- "The SIEM received nothing from a domain controller for six hours and no alert fired." Heartbeat monitoring of log sources.
- "Syslog over UDP loses events during busy periods." Use a reliable, encrypted transport with local buffering.
- "A sharing group publishes indicators for a long-dwell campaign." Search retained logs for them and block them.
What to remember for the exam
- Log the right events, sync clocks, centralize, protect integrity, retain per policy.
- SIEM correlates; SOAR automates; UEBA finds behavioural anomalies.
- Egress monitoring catches exfiltration.
- Use threat intelligence for both blocking and retrospective hunting.
- Runbooks make alert handling consistent.
Logs that are never reviewed provide no detection. Monitoring is an active process.
Common mistakes
Logging locally only, where attackers can erase it.
Relying on UDP syslog where completeness matters.
Blocking indicators without checking past activity.
Check yourself
What does SOAR add to a SIEM?
Automated, playbook-driven response actions.
Why must clocks be synchronized across systems?
So events from different sources can be correlated accurately.
What is egress monitoring for?
Detecting data leaving the organization, such as exfiltration or command-and-control traffic.
Topic 2 of 9 in Security Operations
Test yourself on Security Operations
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.