Monitoring, Logging, and Incident Response
Core concepts
Know the data sources: controller and switch syslog, RADIUS accounting and authentication logs, IDS/IPS alerts, and flow data. Understand severity levels in syslog and the difference between an event, an alert, and an incident. Familiarize yourself with the incident response lifecycle: preparation, detection and analysis, containment, eradication, recovery, and lessons learned.
Understand what logs reveal: repeated 802.1X failures suggest credential attacks or misconfiguration; a spike in deauth frames suggests a wireless DoS; a rogue AP detection event needs triage to confirm whether it is on the wired network. Know the value of centralized logging (SIEM) and time synchronization (NTP) for correlation.
Traps to watch
- Containment before eradication. Isolate the affected host or block the client first; do not jump to rebuilding systems before containing.
- Logs without synchronized time are hard to correlate; NTP is a prerequisite, not an afterthought.
- An alert is not an incident until triage confirms real impact.
- Preserve evidence before remediation; wiping a host destroys forensic data.
Rule of thumb
Follow the lifecycle in order and ask "what phase is this action?" Blocking a port is containment; patching the flaw is eradication; restoring service is recovery; updating policy is lessons learned.
Worked example
A rogue AP alert fires. Triage confirms it is bridged to a corporate switch port. The correct first step is containment: disable that switch port (or apply a deny role) to cut the rogue off, then investigate how it was connected.