Enroll Now Student Login
Cyber Security /Security Monitoring and Defense / Lesson
Cyber Security

Security Monitoring

Security monitoring is the continuous process of observing systems, applications, networks, users and security events to identify suspicious activity, detect threats and respond to security incidents.

🎯

Learning Objectives

Define security monitoring.
Explain why continuous security monitoring is important.
Identify systems and activities that should be monitored.
Distinguish normal activity from suspicious activity.
Explain security events and security alerts.
Describe common sources of security monitoring information.
Explain the role of SIEM systems.
Understand alert fatigue and alert prioritization.
Describe basic security monitoring best practices.

📖

Lesson Content

Security Monitoring

Security monitoring is the continuous observation of computer systems,
networks, applications, users and security events to identify suspicious
activity, detect threats and support a rapid security response.

Modern cybersecurity is not only about preventing attacks. Organizations
must also be able to recognize when something unusual is happening,
investigate the event and take appropriate action.

Learning Objectives

By the end of this lesson, you should be able to:

  • Define security monitoring.
  • Explain why continuous security monitoring is important.
  • Identify systems and activities that should be monitored.
  • Distinguish between normal and suspicious activity.
  • Explain the relationship between monitoring, detection and response.
  • Identify common sources of security monitoring information.
  • Understand the importance of alerts, logs and security events.
  • Describe basic security monitoring practices.

1. What Is Security Monitoring?

Security monitoring is the systematic process of observing technology
environments for events that may indicate security problems.

A security monitoring system may observe:

  • Network traffic
  • User login activity
  • Failed authentication attempts
  • Administrative actions
  • File changes
  • Database activity
  • Application errors
  • Firewall events
  • Malware detections
  • Endpoint activity
  • Cloud activity
  • Configuration changes
  • Privilege changes

The objective is not simply to collect information. The objective is to
use security information to identify events that require investigation
or action.

2. Why Security Monitoring Matters

Attackers can remain inside a compromised environment for extended periods
if suspicious activity is not detected.

Security monitoring helps organizations reduce the time between an attack
and its detection.

Effective monitoring can help detect:

  • Unauthorized access
  • Account compromise
  • Brute-force attacks
  • Malware activity
  • Privilege escalation
  • Suspicious network connections
  • Unauthorized configuration changes
  • Data access anomalies
  • Abnormal application behavior
  • Possible insider threats

3. Prevention Is Not Enough

Security controls such as firewalls, antivirus software, strong passwords
and access controls are important, but no security control is perfect.

A good security strategy therefore includes several stages:

  1. Prevent threats where possible.
  2. Monitor the environment.
  3. Detect suspicious activity.
  4. Investigate security events.
  5. Respond to incidents.
  6. Recover affected systems.
  7. Learn from the incident.

Security monitoring is particularly important because it provides visibility
into what is happening after preventive controls have been deployed.

4. What Should Be Monitored?

Users

Organizations should monitor important user activities such as login
attempts, account creation, password changes, privilege changes and
administrative operations.

Networks

Network monitoring can identify unusual connections, unexpected traffic,
communication with suspicious destinations and abnormal traffic patterns.

Applications

Applications should be monitored for errors, authentication events,
authorization failures, unusual requests and unexpected behavior.

Servers

Servers can generate information about system events, service changes,
authentication attempts, configuration changes and resource usage.

Endpoints

Laptops, desktops and other endpoint devices can be monitored for malware,
unusual processes, unauthorized software and suspicious file activity.

Cloud Resources

Cloud environments should be monitored for account activity, permission
changes, configuration changes, unusual resource access and suspicious
API activity.

5. Security Events

A security event is an observable activity that may be relevant to the
security of a system.

Examples include:

  • A successful login.
  • A failed login.
  • A password change.
  • A new administrator account.
  • A firewall rule change.
  • A file permission change.
  • A malware detection.
  • A connection to a suspicious destination.

Not every security event represents an attack. Security professionals must
analyze events and determine whether they are normal, suspicious or
malicious.

6. Normal Activity vs Suspicious Activity

One of the most important parts of security monitoring is understanding
normal system behavior.

For example, a user logging into an application during normal working
hours from a known device may be expected.

However, the same account attempting to log in hundreds of times from
multiple unusual locations may require investigation.

Possible indicators of suspicious activity

  • Repeated failed login attempts.
  • Login activity at unusual times.
  • Access from unexpected locations.
  • Unexpected privilege escalation.
  • Large volumes of data being accessed.
  • Unknown processes running on an endpoint.
  • Unexpected changes to security settings.
  • Communication with suspicious systems.

7. Security Monitoring Sources

Security monitoring depends on information collected from different
sources.

Common sources include:

  • Application logs
  • Operating system logs
  • Firewall logs
  • Web server logs
  • Authentication logs
  • Database logs
  • Endpoint security software
  • Intrusion detection systems
  • Intrusion prevention systems
  • Cloud security platforms
  • Network monitoring systems

These sources can be combined to provide a broader picture of activity
across an organization’s environment.

8. Logs and Monitoring

Logs are records of activities and events generated by systems and
applications.

For example, an authentication log may record:

  • Username
  • Time of login
  • IP address
  • Success or failure
  • Authentication method

Logs become particularly useful when they are collected, protected,
searched and analyzed as part of a security monitoring process.

9. Security Alerts

A security alert is a notification that an event or combination of events
may require attention.

Examples include:

  • Multiple failed login attempts.
  • Malware detection.
  • Unauthorized administrator activity.
  • Suspicious network communication.
  • Unexpected privilege changes.

Alerts should be prioritized according to their potential impact and
likelihood of representing a real threat.

10. Monitoring and Detection

Monitoring provides visibility, while detection involves identifying
events that may represent a security threat.

For example:

  1. A server records several failed logins.
  2. The monitoring system collects the events.
  3. A detection rule identifies the unusual pattern.
  4. An alert is generated.
  5. A security analyst investigates.

This demonstrates how monitoring supports the larger security detection
and response process.

11. Continuous Monitoring

Security monitoring should ideally operate continuously rather than only
when a security team suspects an attack.

Continuous monitoring helps organizations detect changes and suspicious
activity as they occur.

However, continuous monitoring does not necessarily mean that a human must
watch a screen every second. Automated collection, detection rules,
alerts and dashboards can assist security teams.

12. Security Information and Event Management

Security Information and Event Management, commonly called SIEM, is a
technology approach used to collect, centralize, correlate and analyze
security-related information from multiple sources.

A SIEM platform can help security teams:

  • Collect logs.
  • Search security events.
  • Correlate related events.
  • Generate alerts.
  • Investigate suspicious activity.
  • Create security dashboards.
  • Support incident investigations.

SIEM technology is useful in environments where security teams need
centralized visibility across many systems.

13. Monitoring Does Not Replace Security Controls

Monitoring is not a replacement for secure configuration, access control,
patching, encryption, backups, endpoint protection or other preventive
security controls.

Instead, monitoring complements those controls by providing visibility
into whether systems are behaving as expected.

14. Protecting Monitoring Systems

Security monitoring infrastructure must itself be protected.

If attackers can modify or delete security records, investigators may lose
important evidence.

Monitoring systems should therefore have:

  • Strong access controls
  • Authentication
  • Authorization
  • Secure transmission
  • Protected storage
  • Appropriate retention
  • Administrative logging

15. Avoiding Alert Fatigue

If a monitoring system produces too many unnecessary alerts, security
analysts may become overwhelmed.

This problem is known as alert fatigue.

Good monitoring programs therefore attempt to reduce false positives and
prioritize meaningful security events.

16. Basic Security Monitoring Workflow

  1. Collect security events.
  2. Normalize and organize the information.
  3. Analyze events.
  4. Identify suspicious patterns.
  5. Generate alerts.
  6. Prioritize alerts.
  7. Investigate suspicious activity.
  8. Respond when necessary.
  9. Document the event.
  10. Improve controls based on lessons learned.

17. Example Monitoring Scenario

Imagine that an administrator account normally logs in from one office
during business hours.

The monitoring system suddenly records:

  • Twenty failed login attempts.
  • A successful login from an unusual location.
  • A privilege change.
  • Access to sensitive files.

Individually, some of these events might not prove an attack.
However, together they form a suspicious pattern.

A security analyst should investigate the account, verify whether the
activity was authorized and take appropriate response actions if
compromise is suspected.

18. What Security Analysts Look For

Security analysts commonly investigate patterns rather than isolated
events.

Examples include:

  • Repeated authentication failures.
  • Unexpected administrative actions.
  • Unusual data access.
  • Unexpected system changes.
  • Abnormal network traffic.
  • Known malicious indicators.
  • Unexpected software execution.
  • Multiple related events across systems.

19. Security Monitoring Best Practices

  • Monitor important systems continuously.
  • Collect useful security events.
  • Protect logs from unauthorized modification.
  • Use accurate system time.
  • Centralize important security information.
  • Prioritize alerts.
  • Reduce unnecessary alerts.
  • Review monitoring rules regularly.
  • Restrict access to monitoring systems.
  • Document security incidents.
  • Regularly test monitoring capabilities.
  • Use monitoring results to improve security.

20. Common Mistakes

  • Monitoring only after an attack occurs.
  • Collecting logs without reviewing them.
  • Ignoring repeated failed logins.
  • Allowing too many people to access monitoring systems.
  • Generating excessive low-value alerts.
  • Failing to synchronize system clocks.
  • Deleting security records too quickly.
  • Failing to investigate suspicious activity.
  • Logging sensitive secrets such as passwords and access tokens.

21. Practical Lab

Create a simple security monitoring plan for a small organization.

Your plan should identify:

  1. Five systems that should be monitored.
  2. Five security events that should be collected.
  3. Three suspicious activities that should generate alerts.
  4. Who should receive security alerts.
  5. How suspicious events should be investigated.
  6. How security records should be protected.

22. Knowledge Check

  1. What is security monitoring?
  2. Why is continuous monitoring important?
  3. Give four examples of systems that can be monitored.
  4. What is a security event?
  5. What is a security alert?
  6. Why should security alerts be prioritized?
  7. What is alert fatigue?
  8. What is the purpose of a SIEM?
  9. Why must monitoring systems themselves be protected?
  10. Explain the difference between monitoring and incident response.

23. Key Terms

  • Security Monitoring: Continuous observation of systems and activities for security threats.
  • Security Event: An observable activity relevant to security.
  • Security Alert: A notification indicating that an event may require investigation.
  • SIEM: Security Information and Event Management.
  • Log: A recorded event or activity generated by a system or application.
  • Detection: The process of identifying potentially malicious activity.
  • Alert Fatigue: Reduced effectiveness caused by excessive or low-value alerts.
  • Incident: A security event that requires investigation or response.

24. Summary

Security monitoring provides visibility into what is happening across
systems, networks, applications and users.

Effective monitoring helps organizations detect suspicious behavior,
investigate security events and respond to incidents more quickly.

A strong monitoring program combines useful logs, security alerts,
automated detection, human analysis, protected monitoring infrastructure
and continuous improvement.

Remember that monitoring is only one part of cybersecurity. It works
together with prevention, access control, endpoint security, backups,
security policies and incident response.

Next Lesson

In the next lesson, we will study Logs in greater detail,
including log types, log collection, log analysis, log protection,
retention and how logs support security investigations.

💻

Code Example

<?php

/*
 * Simple PHP security monitoring example.
 *
 * This example records a security event without
 * storing passwords, tokens or other secrets.
 */

$username = 'admin@example.com';

$event = array(
	'event'     => 'authentication_failure',
	'account'   => $username,
	'timestamp' => gmdate( 'c' ),
	'ip'        => isset( $_SERVER['REMOTE_ADDR'] )
		? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) )
		: 'unknown',
);

error_log(
	wp_json_encode( $event )
);

/*
 * Never log:
 *
 * - Passwords
 * - Session tokens
 * - API keys
 * - Private keys
 * - Authentication credentials
 */
⭐

Key Takeaways

Security monitoring provides visibility into systems and activities.
Monitoring supports threat detection and incident response.
Important systems, users, networks and applications should be monitored.
Security events do not automatically mean that an attack has occurred.
Logs provide valuable evidence for monitoring and investigations.
Security alerts should be prioritized according to risk.
SIEM platforms can centralize and correlate security information.
Monitoring infrastructure must itself be protected.
Alert fatigue can reduce the effectiveness of a security team.
Monitoring should continuously improve as new threats and lessons are identified.

Enjoying this lesson?

Sign in to your Dwallnet Academy student account to track your learning progress and mark lessons as complete.

Sign In to Track Progress