Threat Detection and Monitoring
Threat Detection and Monitoring
This domain tests how detection actually works: log pipelines, correlation logic, tuning, and the analyst judgement that separates a real signal from noise.
Core rules
- SIEM pipeline: collection, parsing and normalization, correlation, alerting, retention. Weak parsing produces silent gaps.
- All sources must share accurate time via NTP; unsynchronized clocks break correlation and timelines.
- IOCs are artifacts (hashes, domains, IPs) and age quickly. IOAs describe behavior and survive infrastructure changes.
- Map detections to MITRE ATT&CK techniques to find coverage gaps rather than counting rules.
- EDR gives endpoint telemetry and response; NDR covers network; UEBA baselines user behavior.
- Threat hunting starts from a hypothesis, not from an alert queue.
- Track false positive rate and false negative risk; every tuning decision trades one for the other.
Worked example
A rule fires when five failed logons occur within five minutes followed by a success from the same source. In testing it fires constantly because a backup service account authenticates with a stale cached credential. Rather than disabling the rule, exclude that account from the threshold, add a separate low-severity rule for service-account failures, and verify the exclusion is documented with an owner and expiry date.
Traps that cost marks
- Ignoring the base rate fallacy: a highly sensitive rule on a rare event still produces mostly false positives.
- Retiring noisy rules instead of tuning them, which quietly creates blind spots.
- Assuming the SIEM is set-and-forget; log sources change and parsers break silently.
- Treating a stale IOC feed as durable detection.