Security Monitoring, Logging, and Detection Engineering
Why logs are security evidence
Monitoring goal
Security monitoring detects suspicious activity, supports incident response, and creates evidence for later analysis. Good monitoring is selective, consistent, and tied to business risk rather than collecting everything.
Useful log sources
| Source | Examples of value |
|---|---|
| Authentication logs | Failed logins, MFA challenges, impossible travel |
| Endpoint logs | Process creation, malware alerts, file changes |
| Network logs | Unexpected connections, beaconing, exfiltration |
| Cloud logs | Privilege changes, storage access, API calls |
Detection concepts
Good logging practice
Logs should be time-synchronized, protected from tampering, and retained long enough to support investigations and compliance needs.
Building a practical detection workflow
-
1
Define high-value behaviors to monitor.
-
2
Collect the right logs from endpoints, identity, network, and cloud.
-
3
Create rules or analytics that detect suspicious patterns.
-
4
Tune alerts to reduce false positives.
-
5
Document investigation steps and response actions.
What is the main purpose of a baseline?
Baselines help distinguish normal activity from anomalies.
Correct answer: To define normal behavior for comparison
Why should logs be time-synchronized?
Accurate time is essential for investigations.
Correct answer: So events from different systems can be ordered and correlated accurately
Which log source is most directly useful for detecting unusual privilege changes in cloud systems?
Cloud logs capture identity and administrative actions.
Correct answer: Cloud logs
What is alert triage?
Triage helps teams focus on the most important events first.
Correct answer: The process of reviewing and prioritizing alerts based on severity and context