Security Monitoring: Telemetry Sources, Alert Disposition, and SIEM
Know which telemetry answers which question
- Logs (syslog, Windows Event Log, application logs) record discrete events. Syslog severity runs 0 (emergency) to 7 (debug).
- Flow data (NetFlow/IPFIX) records who talked to whom, on which port, how much, and for how long - but never payload. If a question asks about volume without content, the answer is flow.
- Full packet capture (PCAP) gives headers and payload but is storage-expensive, so it is often sampled or time-bounded.
- SNMP polls device health; traps push alerts.
- Alerts come from IDS/IPS, EDR, antivirus, DNS security, proxies, and SIEM correlation rules.
IDS vs IPS: an IDS inspects a copy of traffic out of band and alerts; an IPS sits inline and can block. HIDS watches one host's files and processes; NIDS watches a network segment.
Alert disposition is heavily tested: true positive (real bad event, alerted), false positive (benign, alerted), true negative (benign, silent), false negative (bad event, silent - the dangerous one). Tuning reduces false positives; it cannot fix a miss you never saw.
Event vs alert vs incident: an event is any observable occurrence, an alert is a notification that a rule matched, an incident is confirmed harm or policy violation requiring response. In scenario questions, do not escalate a single benign alert to "incident" without corroboration.
A SIEM centralizes, normalizes, correlates, and retains logs; it does not capture packets or replace an IPS. NTP synchronization matters because correlation across sources fails when clocks drift.
Worked example: a SIEM rule fires on 500 failed logons from one internal host to many servers in two minutes. Logs supply the events, flow data shows the fan-out, and the one-source/many-destinations pattern reads as credential spraying or lateral movement - corroborate before containing.
Rule of thumb: content → PCAP, volume and pattern → flow, audit trail → logs, device health → SNMP.