Security Monitoring
Domain 2, Security Monitoring, is the largest slice at roughly 25%. It asks where evidence comes from, how it is normalized and correlated, and how an analyst moves from a raw alert to a defensible conclusion.
Choosing telemetry
- Full packet capture answers what was said: payload, headers, files. Storage-heavy, often limited to key segments.
- Flow data (NetFlow, IPFIX) answers who talked to whom, when, how much. A flow is unidirectional and keyed on the 5-tuple: source IP, destination IP, source port, destination port, protocol. NetFlow v5 is fixed-format; v9 and IPFIX use templates. No payload.
- Logs give event context: firewall permits and denies, proxy URL and user, DNS queries, authentication results. Syslog severity runs 0 (emergency) to 7 (debug), commonly over UDP 514.
- Endpoint telemetry (EDR, Sysmon, Windows Security log) supplies process ancestry and command lines invisible on the wire.
Making data usable
A SIEM collects, parses and normalizes, correlates and alerts. Correlation depends on synchronized clocks, so NTP is a monitoring control. Baselines define normal; tuning lowers false positives but can raise false negatives. Triage: validate the alert, identify asset and user, scope related activity, preserve evidence, escalate or close.
Worked example
A SIEM rule fires: 40 Windows 4625 failures for svc_backup in two minutes, one 4624 success from the same source, then 4740 lockouts on three other accounts.
Reasoning: 4625 is failed logon; a burst followed by 4624 suggests guessing that succeeded, not a typo. Check the source workstation, whether the successful session spawned 4688 or Sysmon process-creation events, and NetFlow for outbound connections from the target. Lockouts on other accounts suggest spraying. Contain the source host, reset the service account, and hunt the source IP in proxy and VPN logs. Do not close on the 4624 alone.
Traps
- Claiming NetFlow shows payload or URLs.
- Forgetting that encrypted traffic still leaks SNI, certificates, timing and flow size.
- Treating every alert as an incident, or every 4625 as an attack.
- Correlating logs across mismatched time zones.
- Assuming a sensor sees traffic it cannot reach, such as asymmetric routing or switched segments without SPAN or TAP.