Logging, Monitoring, and Detection Review
This domain tests whether relevant activity is logged, centralized, retained, and alerted on.
Sources and events
Know key Windows events: 4624 successful logon, 4625 failed logon, 4688 process creation, 4720 user account created. Sysmon adds Event ID 1 process creation, 3 network connection, 11 file creation, and 22 DNS query. Linux auditd, cloud audit trails, proxy logs, and EDR telemetry round out coverage. Confirm NTP synchronization and UTC normalization.
Detection review
Logging is not monitoring. Check that logs reach the SIEM, that retention meets policy, and that correlation rules fire. Map coverage to MITRE ATT&CK techniques and test with safe simulations. Tune noisy rules and record false-positive rates.
Worked example
Generate ten failed logons (4625) followed by one success (4624) for the same account. The reasoning: this pattern may indicate password spraying or a successful brute force. If the SIEM produces no alert, the gap is detection, not logging. Confirm the raw events exist, then create or tune a rule with a threshold and suppression window.
Traps
Reviewing only dashboards and not raw logs. Timezone mismatches between sources. Ignoring cloud control-plane logs. Treating log retention as detection coverage. Failing to test whether an alert actually reaches an analyst.