Logging, Monitoring, and Response - Telemetry, Detection, and the Feedback Loop
What this domain covers
This domain tests detection and response as an engineering discipline: what telemetry to collect, how to keep logs trustworthy, how to detect and prioritize events, how the incident response lifecycle runs, and how findings feed back into prevention. Scenario questions often describe an attack in progress and ask for the correct phase or the least disruptive containment.
Core rules
- Observability rests on logs, metrics and traces; OpenTelemetry provides vendor-neutral instrumentation so tooling can change without re-instrumenting applications.
- Logs should be structured (JSON), centrally aggregated, time-synchronized, correlated by request and trace identifiers, integrity-protected through append-only or write-once storage, and retained per legal and contractual requirements. Never log secrets, tokens or unnecessary personal data.
- Detection: SIEM correlation rules, detection-as-code reviewed like software, baselines with anomaly alerting, and tuning to control alert fatigue. Track mean time to detect, acknowledge and remediate separately.
- Threat hunting and purple-team exercises find what rules miss; tabletop exercises test the human process before a real incident.
- Incident response lifecycle: preparation; detection and analysis; containment, eradication and recovery; post-incident activity. Containment choices trade speed against evidence preservation and business disruption.
- Runbooks and SOAR playbooks automate routine containment such as disabling an identity, blocking an address range or revoking tokens.
- Blameless postmortems convert incidents into backlog items and new detections, closing the learning loop.
- Notification duties are time-bound: for example, GDPR requires breach notification within 72 hours of awareness where required, and contracts may impose shorter windows.
Worked example
Monitoring shows 500 failed logins per minute across many accounts from distributed addresses, with a few successes. Reasoning: the pattern is credential stuffing, not a single brute force, so per-IP blocking is insufficient. Detection fires on the aggregate failure rate plus impossible-travel signals. Triage confirms the accounts targeted. Containment applies rate limiting, step-up authentication and ASN blocking while preserving logs for analysis. Eradication forces credential resets for accounts that succeeded. Recovery monitors for renewed attempts. The postmortem adds bot defense and impossible-travel detection rather than blaming users.
Traps that cost marks
- Logging everything with no retention, integrity or cost plan, or logging credentials and personal data.
- Leaving noisy alerts untuned until analysts ignore them.
- An incident response plan that has never been exercised.
- Postmortems that name individuals, which suppresses future reporting.
- Confusing detection time with remediation time in metrics answers.