Explain security alerting and monitoring concepts and tools
SIEM, SNMP, NetFlow, antivirus, DLP, SCAP, and the monitoring lifecycle from alert to tuning.
- Reading time
- 26 min read
- Flashcards
- 19 cards
- Practice questions
- 10 questions · 2 PBQs
4.9 was about reading a source once you know which one you need. This objective is about the machinery that produces those sources, and the loop a SOC runs continuously.
The monitoring loop
Log aggregation → alerting → response → tuning → archiving, then round again.
The step people forget is tuning, and it is the one the exam rewards. A monitoring system that fires constantly gets ignored, and an ignored alert is functionally the same as no alert at all.
Check yourself
A SOC receives 4,000 alerts a day, most benign. A real intrusion goes unnoticed for a week. What is the most appropriate response?
What gets monitored
CompTIA splits it three ways, and questions do use these words:
- Systems — servers, workstations, the hosts themselves.
- Applications — the software running on them.
- Infrastructure — network devices, cloud services, the plumbing.
SIEM
A Security Information and Event Management platform does four things: collect logs from everywhere, normalise them into a common format, correlate across sources, and alert.
Correlation is the part that matters. A failed login on one host is nothing. A failed login on forty hosts from one source in two minutes is an attack — and no single log could tell you that, because each host only sees its own share.
SOAR
Security Orchestration, Automation and Response. Where a SIEM detects and alerts, SOAR acts — running a playbook that enriches the alert, opens a ticket, or isolates a host automatically. Covered further in 4.7.
SIEM
- Collects, normalises, correlates, alerts
- Tells you something happened
SOAR
- Runs automated response playbooks
- Does something about it
The tellSIEM detects. SOAR responds. If the stem describes automatic containment or ticket creation, it is SOAR.
Agent vs agentless
Agent-based
- Software installed on each host
- Deeper visibility, works offline
- Deployment and maintenance overhead
Agentless
- Polls remotely over the network
- Nothing to install
- Less depth, needs connectivity and credentials
The tellDepth versus deployment cost. If the stem stresses detailed endpoint visibility, it is agent-based; if it stresses not touching the hosts, agentless.
The tools
Antivirus / anti-malware
Signature and behaviour-based detection of known malicious software on endpoints.
DLP
Data Loss Prevention — inspects data in motion, at rest and in use, blocking sensitive information from leaving. If a stem describes stopping card numbers being emailed out, it is DLP.
SNMP trap
A network device pushing an alert to a manager when a condition occurs, rather than waiting to be polled. Push, not pull.
NetFlow
Flow records of who talked to whom, how much, when. No payload — see 4.9.
Vulnerability scanner
Identifies known weaknesses. See 4.3 for the lifecycle around it.
SCAP
Security Content Automation Protocol. Lets tools from different vendors express security content and findings consistently, so a benchmark can be checked automatically.
Benchmarks
Published secure configuration standards, most commonly CIS Benchmarks. Used to define and audit a secure baseline.
Check yourself
An organisation wants to prevent employees emailing customer credit card numbers to external addresses. Which tool?
Alert response
Once an alert fires, the exam expects a specific vocabulary:
Quarantine — isolate the file or host so it cannot cause further harm. The malware equivalent of containment.
Alert tuning — adjust the rule after investigating, whether it was a false positive (raise the threshold) or a true positive that fired too late (lower it).
Validation — confirm the response actually worked, the same principle as rescanning in 4.3.
Archiving and retention
Logs must be retained long enough to investigate an incident discovered late — and breaches are routinely found months after the fact. Retention periods are commonly driven by regulation rather than by preference.
Archiving moves older logs to cheaper storage. The trade-off the exam probes: archived logs are slower to search, so retention policy balances investigative need, regulatory requirement and cost.