Security monitoring
Security monitoring
Security monitoring definition
Security monitoring refers to the ongoing process of collecting, analyzing, and escalating security-related information to detect security incidents in real time. It involves using various tools to provide visibility into an organization’s infrastructure, ensuring that any malicious activities or potential threats can be identified and dealt with promptly.
See also: real-time data, data retrieval, data logging
How does security monitoring work?
- Data collection. Data logs must first be collected from servers, firewalls, routers, switches, intrusion detection systems (IDS), intrusion prevention systems (IPS), applications, and end-user devices.
- Centralized logging. Because logs are generated across many devices and applications, they are often analyzed by a centralized application.
- Data enrichment. As data is ingested, it might be enriched with contextual information. For example, an IP address could be cross-referenced with threat intelligence feeds to check if it’s associated with known malicious actors.
- Real-time analysis. Data is analyzed in real-time, looking for patterns or signatures of known threats.
- Alerting. If the system detects anomalous or malicious activity, it alerts the system administrator.
- Incident investigation. Security analysts investigate the root cause for the alert, usually by examining network traffic, analyzing malware, or reviewing system behaviors.
- Incident response. If the investigation confirms a security incident, a formal incident response process begins by containing the threat and system recovery.
- Retrospective analysis. Beyond real-time analysis, historical data is reviewed to detect threats that might have been missed earlier or to understand the full scope of a known breach.