Security Operations and Monitoring
Security Operations and Monitoring tests how alerts are produced, triaged, and turned into action. Expect questions on log sources, correlation, detection trade-offs, and the operational metrics a SOC is measured by.
Core rules
- Detection has three families: signature (known-bad patterns, low false positives, no zero-day coverage), anomaly (baseline deviation, high noise, needs tuning), and behavioural or heuristic (technique-based, best against living-off-the-land activity).
- A SIEM normalises and correlates logs; it does not create visibility that was never logged. Coverage gaps start at the sensor and log-source inventory.
- Know the Windows events: 4624 successful logon, 4625 failed logon, 4634 logoff, 4672 special privileges assigned, 4688 process creation (needs audit policy enabled), 4720 account created.
- Logon types matter: 2 interactive, 3 network, 10 remote interactive, 5 service.
- Useful telemetry: NetFlow for east-west volume, DNS logs for beaconing, proxy logs for egress, EDR for process trees, authentication logs for credential attacks.
- Track MTTD and MTTR, plus alert-to-incident ratio. A rule that fires 900 times a day and is closed as benign is worse than no rule, because it trains analysts to ignore it.
Worked example
A correlation rule fires on 30 failed logons (4625) for 20 distinct accounts from one source IP inside four minutes, followed by a 4624 logon type 3 from that IP. Single-account failures are ignored, because the base rate of mistyped passwords is high; the distinct-account count is the discriminator. The pattern is a password spray that succeeded, so the response is to disable the source, force a reset for the 20 targeted accounts, and check what the successful session touched. Adding a country or ASN condition is fine as a tuning step, but it must not become the only condition, or the rule misses compromised domestic infrastructure.
Traps that cost marks
- Confusing an IPS blocking action with an IDS alert, and mislabelling which device sits inline.
- Ignoring the base rate fallacy: a highly sensitive rule on a rare event still yields mostly false positives.
- Assuming logs are complete when the audit policy or forwarding agent was never configured.
- Reporting raw alert volume as evidence of detection quality.