Security Operations and Monitoring
Security Operations and Monitoring
This domain tests telemetry selection, detection engineering, alert triage, and the metrics that prove a SOC works. Most items ask which data source would actually answer a question, or which detection logic would catch a described behavior without drowning the queue.
Know what each source can and cannot tell you
- Endpoint: EDR telemetry; Windows Event IDs such as 4624 (successful logon), 4625 (failed logon), 4688 (process creation), 4720 (account created); Sysmon for granular process and network events.
- Network: firewall, proxy, DNS query logs, NetFlow/IPFIX - metadata only, no payload - and full packet capture for deep analysis.
- Identity: domain controller logs, IdP sign-in logs, MFA failure patterns.
- Cloud: control-plane audit logs, object-storage access, key-management events.
- Application and database audit trails for business-logic abuse.
SIEM and detection logic
A SIEM normalizes, correlates, and alerts; it does not remediate - that is SOAR or EDR response. Detection styles: rule/threshold, anomaly against a baseline, and threat-intelligence match. NTP time synchronization is a prerequisite, because skew silently destroys correlation and timeline accuracy. Tune aggressively, but document every suppression so it cannot later hide real activity.
SOC workflow and metrics
Triage means validate, scope, classify severity, then escalate or close with a reason. Useful metrics: MTTD, MTTR, alert-to-case ratio, false-positive rate, and ATT&CK technique coverage. High alert severity is not the same as a confirmed incident.
Threat intelligence
Indicator types: IP, domain, URL, file hash, certificate. STIX structures the data; TAXII transports it. Intelligence decays - expire indicators and record confidence. Honeypots produce almost no noise by design, so any interaction with one is high signal.
Worked example
"Detect password spraying." Build a rule counting 4625 failures across many distinct accounts from a single source IP within ten minutes, alerting above roughly 20 distinct accounts, excluding service accounts and known scanners. This requires centralized log collection across all domain controllers and NTP alignment. A per-host threshold would never fire, because spraying deliberately keeps each account's failure count low.
Traps
NetFlow has no payload, so it cannot reveal credentials or commands. A SIEM is not an IDS. Deleting or rotating logs during an active incident destroys evidence and may violate legal hold.