02 Security Monitoring

Welcome to:

Module 02 — Security Monitoring

In the previous module, you learned how Blue Teams and SOC analysts think.

You now understand:

Threats

Telemetry

Alerts

Triage

Investigation

MITRE ATT&CK

Incident Classification

The next question is:

Where Does
Security Evidence
Actually Come From?

A SOC can only investigate what it can see.

Security monitoring therefore begins with:

Visibility

A modern enterprise may contain:

Endpoints

Servers

Network Devices

Cloud Accounts

Applications

Identity Platforms

Email Systems

SaaS Platforms

Containers

Security Tools

Each produces different forms of:

Security Telemetry

The job of the monitoring architecture is to bring that information together so analysts can:

Search

Correlate

Detect

Investigate

Respond

Module Objectives

By the end of this module, you will understand how to:

• explain the purpose of security monitoring.

• understand security monitoring architecture.

• understand SIEM architecture.

• distinguish log generation, collection and analysis.

• identify major security telemetry sources.

• understand centralized logging.

• understand log forwarding.

• understand collectors and agents.

• understand parsing and normalization.

• understand enrichment.

• understand log correlation.

• understand event pipelines.

• understand Windows monitoring.

• understand Linux monitoring.

• understand endpoint telemetry.

• understand EDR and XDR monitoring.

• understand identity monitoring.

• understand network monitoring.

• understand DNS monitoring.

• understand firewall monitoring.

• understand proxy monitoring.

• understand VPN monitoring.

• understand cloud monitoring.

• understand application monitoring.

• understand email monitoring.

• understand SaaS monitoring.

• understand threat-intelligence enrichment.

• understand alert generation.

• understand telemetry coverage.

• identify monitoring gaps.

• understand log retention.

• understand time synchronization.

• understand monitoring health.

• design a basic enterprise SOC monitoring architecture.

1 — What Is Security Monitoring?

Security monitoring is the continuous process of collecting and analyzing information about activity occurring across an organization’s technology environment.

The objective is to identify:

Suspicious Activity

Malicious Activity

Policy Violations

Security Failures

Control Changes

Indicators of Attack

Security monitoring supports:

Detection

Investigation

Threat Hunting

Incident Response

Forensics

Compliance

2 — Security Monitoring Is About Visibility

Consider an attacker who:

Steals Credentials
      ↓
Logs In
      ↓
Creates Admin Account
      ↓
Accesses Cloud Storage
      ↓
Downloads Data

Different stages may appear in:

Identity Logs

Cloud Audit Logs

Application Logs

Network Logs

If the SOC collects only endpoint logs:

Major Parts
of the Attack
May Be Invisible

3 — Monitoring Architecture

A simplified monitoring architecture is:

Systems
      ↓
Logs / Telemetry
      ↓
Collection
      ↓
Processing
      ↓
Normalization
      ↓
Storage
      ↓
Detection
      ↓
Alert
      ↓
SOC Analyst

4 — Security Data Pipeline

Another way to visualize it:

Telemetry Source
      ↓
Collection Agent
      ↓
Transport
      ↓
Log Platform
      ↓
Parsing
      ↓
Normalization
      ↓
Enrichment
      ↓
Detection Logic
      ↓
Alert

Each stage matters.

5 — What Is a SIEM?

SIEM stands for:

Security Information
and
Event Management

A SIEM helps organizations:

Collect

Store

Search

Normalize

Correlate

Analyze

Alert

Report

on security telemetry.

6 — SIEM Is Not Just Log Storage

A basic log server might:

Store Logs

A SIEM typically adds:

Search

Correlation

Detection Rules

Dashboards

Alerting

Case Integration

Threat Intelligence

7 — SIEM Architecture

A simplified enterprise SIEM architecture:

Endpoints ──────────┐
Servers ────────────┤
Identity ───────────┤
Network ────────────┼→ Collectors
Cloud ──────────────┤      ↓
Applications ───────┤   SIEM Platform
Email ──────────────┘      ↓
                          Search
                          Detection
                          Alerting

8 — Telemetry Source

The first component is:

Telemetry Source

Examples:

Windows Server

Linux Server

Firewall

Identity Provider

Cloud Account

Web Application

Email Gateway

Endpoint Security Platform

9 — Log Generation

Before logs can be monitored:

The System
Must Generate Them

This seems obvious, but many monitoring problems begin because:

Logging Was
Never Enabled

10 — Log Collection

Once generated, telemetry must reach the monitoring platform.

Common methods include:

Agent

Syslog

API

Cloud Connector

Event Stream

Native Integration

File Forwarder

11 — Agent-Based Collection

An agent runs on the monitored system.

Example:

Server
      ↓
Monitoring Agent
      ↓
Central Platform

Advantages may include:

Reliable Collection

Local Processing

Encrypted Transport

Endpoint Context

12 — Agentless Collection

Agentless approaches may use:

API

Syslog

Remote Queries

Cloud Services

Example:

Cloud Platform
      ↓
API
      ↓
SIEM

13 — Syslog

Syslog is commonly used by:

Network Devices

Linux Systems

Security Appliances

Firewalls

Conceptually:

Device
      ↓
Syslog
      ↓
Collector
      ↓
SIEM

14 — APIs

Modern cloud and SaaS platforms commonly expose:

Security Events
through APIs

Example:

Identity Provider
      ↓
API
      ↓
Security Platform

15 — Collection Reliability

A major monitoring question is:

Are We
Actually Receiving
the Logs?

Logging enabled does not guarantee:

Logging Collected

16 — Monitoring Pipeline Failure

Example:

Server
Generates Logs

      ↓

Forwarder
Stops Working

      ↓

SIEM Receives
Nothing

The control problem is not:

Logging Disabled

It is:

Collection Failure

17 — Log Parsing

Raw logs may look different across platforms.

Example:

USER=alice
SRC=10.0.0.5
ACTION=LOGIN
RESULT=FAIL

another system may produce:

username: alice
source_ip: 10.0.0.5
authentication_status: failed

Parsing extracts useful fields.

18 — Normalization

Normalization converts different source formats into a common structure.

Example:

User

Source IP

Destination

Event Type

Action

Result

Timestamp

This allows queries across different platforms.

19 — Why Normalization Matters

Without normalization:

Windows
Uses One Field

Cloud
Uses Another

Application
Uses Another

A detection may need separate logic for every platform.

Normalized data allows:

Common
Detection Logic

20 — Enrichment

Enrichment adds context to raw events.

Raw event:

User:
alice

Source IP:
203.0.113.20

Enriched event:

User:
alice

Role:
Finance Manager

Account Type:
Privileged

Source IP:
203.0.113.20

Country:
X

Threat Reputation:
Suspicious

21 — Common Enrichment Sources

Examples:

Asset Inventory

Identity Directory

Threat Intelligence

GeoIP

Vulnerability Data

Business Criticality

CMDB

22 — Correlation

Correlation connects related events.

Example:

20 Failed Logins
      ↓
Successful Login
      ↓
New Administrator
      ↓
Large Download

These may occur in different data sources.

Correlation helps the SOC see:

The Pattern

23 — Correlation Rule Example

Conceptually:

IF

Multiple Failed Logins

FOLLOWED BY

Successful Login

FROM

Same IP

WITHIN

10 Minutes

THEN

Generate Alert

24 — Event Aggregation

Many systems produce repeated events.

Example:

1000
Firewall Blocks

Aggregation may summarize:

Source IP

Destination

Port

Count

Time Window

rather than displaying every event individually.

25 — Event Deduplication

Some events may be identical.

Deduplication can reduce:

Noise

Storage

Analyst Workload

But careless deduplication can also remove useful context.

26 — Timestamps

Every investigation depends on:

Time

Events must contain reliable timestamps.

27 — Time Synchronization

Systems should use consistent time sources.

If one system is:

10 Minutes Ahead

and another:

5 Minutes Behind

your incident timeline may become misleading.

28 — NTP

Network Time Protocol helps synchronize system clocks.

Consistent time is critical for:

Correlation

Investigation

Forensics

Audit

29 — Time Zones

Analysts must understand whether timestamps use:

UTC

Local Time

Server Time

User Time Zone

Always normalize time when building incident timelines.

30 — Windows Monitoring

Windows environments produce important security telemetry.

Common areas include:

Authentication

Account Management

Process Creation

Service Creation

Scheduled Tasks

PowerShell

Group Changes

Privilege Usage

31 — Windows Security Event Log

Windows Security logs can provide information about:

Logons

Logoff

Account Changes

Privilege Use

Authentication Failures

Audit Events

32 — Process Creation

Process events can help analysts understand:

Which Program Ran?

Who Started It?

What Was the Parent?

Which Command Was Used?

This is essential for detecting suspicious execution.

33 — Command-Line Logging

Command-line information may reveal:

Encoded Commands

Downloads

Credential Tools

Reconnaissance Commands

Persistence Commands

34 — PowerShell Monitoring

PowerShell is widely used by:

Administrators

Developers

Security Teams

Attackers

Therefore:

PowerShell
      ≠
Malicious

Context and command behavior matter.

35 — Sysmon

Sysmon can provide detailed Windows telemetry such as:

Process Creation

Network Connections

File Creation

Registry Changes

Driver Loading

when appropriately configured.

36 — Linux Monitoring

Linux monitoring commonly uses:

Authentication Logs

System Logs

Audit Frameworks

Application Logs

Shell Activity

37 — Linux Authentication

Useful events may include:

Successful SSH Login

Failed SSH Login

sudo Usage

Account Changes

38 — Linux Audit

Linux audit frameworks can record:

System Calls

File Access

Privilege Changes

Command Execution

depending on configuration.

39 — Endpoint Detection and Response

EDR stands for:

Endpoint
Detection
and
Response

EDR provides deeper visibility into endpoint activity.

40 — EDR Telemetry

Typical EDR data may include:

Processes

Command Lines

Files

Registry

Network Connections

Users

Hashes

Behavior

41 — EDR Capabilities

EDR platforms may support:

Detection

Investigation

Threat Hunting

Process Trees

Endpoint Isolation

File Quarantine

42 — Process Tree

A process tree helps understand relationships.

Example:

outlook.exe
      ↓
winword.exe
      ↓
powershell.exe
      ↓
cmd.exe

This sequence may be suspicious depending on context.

43 — Parent-Child Relationships

A detection can look for unusual relationships such as:

Office Application
      ↓
Command Shell

or:

Browser
      ↓
PowerShell

44 — XDR

XDR typically extends detection and response across multiple security domains.

It may correlate:

Endpoint

Identity

Email

Cloud

Network

telemetry.

45 — Identity Monitoring

Identity is one of the most important modern monitoring domains.

Monitor:

Successful Logins

Failed Logins

MFA

Password Resets

Role Changes

Session Activity

New Accounts

Disabled Accounts

46 — Authentication Monitoring

Useful questions include:

Who Logged In?

From Where?

Using Which Device?

Was MFA Used?

Was the Login Successful?

Was This Normal?

47 — Failed Login Monitoring

One failed login may be normal.

Thousands may indicate:

Password Spray

Brute Force

Credential Stuffing

Context matters.

48 — Successful Login After Failures

Sequence:

50 Failed Logins
      ↓
1 Successful Login

may deserve higher attention than either event alone.

49 — Impossible Travel

A monitoring system might identify:

Login in Country A

10 Minutes Later

Login in Country B

This may indicate compromise.

But it may also result from:

VPN

Proxy

Cloud Service

Incorrect GeoIP

Investigation is still required.

50 — MFA Monitoring

Monitor:

MFA Success

MFA Failure

MFA Denial

MFA Registration

MFA Removal

Authentication Method Change

51 — MFA Fatigue

Repeated authentication prompts may indicate:

MFA
Push Fatigue

Potential pattern:

Repeated MFA Denials
      ↓
One Approval

This may warrant investigation.

52 — Privilege Monitoring

Monitor events such as:

New Administrator

Role Assignment

Privilege Escalation

Group Membership Change

Cloud IAM Policy Change

53 — Service Account Monitoring

Service accounts may have:

Powerful Permissions

Long-Lived Credentials

Non-Interactive Usage

Monitor:

Unexpected Interactive Login

Credential Changes

New Privileges

Unusual Source Systems

54 — Network Monitoring

Network telemetry helps analysts understand:

Connections

Protocols

Destinations

Traffic Volume

Communication Patterns

55 — Firewall Logs

Firewalls may record:

Source IP

Destination IP

Source Port

Destination Port

Protocol

Allow / Deny

Rule

56 — Firewall Monitoring Use Cases

Examples:

Repeated Connection Attempts

Unexpected Outbound Traffic

Connections to Known
Malicious IPs

Access to Restricted Ports

57 — DNS Monitoring

DNS logs record domain-resolution activity.

They can help identify:

Malicious Domains

Command and Control

Suspicious Subdomains

Unusual DNS Patterns

58 — DNS Query Example

Endpoint
      ↓
Queries
evil-example.test

Questions:

Which Process?

Which User?

Was Connection Made?

Did Other Hosts
Query It?

59 — Domain Reputation

A domain being newly registered or suspicious can add context.

But:

Suspicious Domain
      ≠
Confirmed Compromise

60 — Proxy Monitoring

Proxy logs can provide:

User

URL

Domain

Destination

Request

Response

Data Volume

Useful for:

Web-Based Malware

Phishing

Data Exfiltration

Command and Control

61 — VPN Monitoring

VPN logs provide:

User

Source IP

Authentication

Session Start

Session End

Assigned IP

Device Context

62 — IDS and IPS

IDS:

Intrusion
Detection System

IPS:

Intrusion
Prevention System

They may identify suspicious network patterns or known attack signatures.

63 — IDS Alert Limitation

An IDS signature match does not always mean:

Successful Attack

The analyst should determine:

Was Target Vulnerable?

Did Connection Succeed?

Was Exploitation Successful?

What Happened Next?

64 — Network Flow

Flow data can summarize:

Source

Destination

Port

Protocol

Bytes

Duration

without full packet contents.

65 — Network Detection and Response

NDR may use:

Network Telemetry

Behavior Analytics

Protocol Analysis

to identify suspicious activity.

66 — Cloud Monitoring

Cloud monitoring is critical because cloud activity often occurs through:

APIs

rather than traditional interactive access.

67 — Cloud Audit Logs

Cloud audit telemetry can reveal:

Who Called an API?

Which Action?

Which Resource?

From Which IP?

Was It Successful?

What Changed?

68 — Cloud Identity Monitoring

Monitor:

New Users

New Roles

New Access Keys

Privilege Changes

Authentication

MFA Changes

69 — Cloud Resource Monitoring

Monitor changes to:

Storage

Network Rules

Virtual Machines

Databases

Encryption

Logging

Security Services

70 — Storage Monitoring

High-value events include:

Bucket Made Public

Encryption Disabled

Large Data Download

Access Policy Changed

Logging Disabled

71 — Cloud Network Monitoring

Monitor:

Security Group Changes

Firewall Rules

Public Exposure

Flow Logs

Load Balancer Events

72 — Cloud Logging Gaps

A major problem occurs when:

New Cloud Account
Created
      ↓
Logging Not Integrated
      ↓
SOC Has No Visibility

This is a monitoring coverage gap.

73 — Application Monitoring

Applications should log security-relevant actions.

Examples:

Login

Logout

Failed Login

Admin Actions

User Creation

Permission Changes

Sensitive Transactions

Errors

74 — Application Context

Application logs may provide business context unavailable elsewhere.

Example:

User Exported
100,000
Customer Records

A network log may show only:

Large HTTPS Transfer

The application log explains what happened.

75 — Web Server Monitoring

Useful events include:

HTTP Requests

Response Codes

User Agents

URLs

Source IPs

Request Size

76 — Web Attack Indicators

Potential patterns:

SQL Injection Attempts

Directory Traversal

Command Injection

Scanning

Repeated 404s

Suspicious User Agents

77 — Email Monitoring

Email is a major initial-access channel.

Monitor:

Sender

Recipient

Subject

URL

Attachment

Authentication

Delivery

Mailbox Activity

78 — Email Authentication

Important technologies include:

SPF

DKIM

DMARC

These help evaluate whether email was authorized by the sender’s domain.

79 — Mailbox Activity

After account compromise, attackers may:

Create Inbox Rules

Forward Email

Delete Messages

Search Mailbox

Send Internal Phishing

These actions may generate valuable telemetry.

80 — SaaS Monitoring

Organizations increasingly depend on:

Collaboration Platforms

CRM

File Sharing

HR Platforms

Business Applications

Monitor:

Authentication

Administrative Changes

Sharing

Downloads

API Activity

User Management

81 — Security Tool Telemetry

Security tools themselves produce useful information.

Examples:

EDR Alerts

Vulnerability Findings

DLP Events

CASB Events

Email Security Alerts

Cloud Security Findings

82 — Vulnerability Context

A SIEM alert involving a system with:

Critical
Unpatched Vulnerability

may deserve greater priority.

This is an example of:

Contextual
Enrichment

83 — Threat Intelligence Enrichment

Events may be enriched with:

Malicious IP Reputation

Known C2 Domain

Malware Hash

Threat Actor Infrastructure

84 — Threat Intelligence Limitation

Do not automatically block or escalate only because:

Threat Feed
Says Malicious

Evaluate:

Source Quality

Freshness

Confidence

Context

Internal Activity

85 — Alert Generation

Alerts may come from:

SIEM Rules

EDR

NDR

Identity Security

Cloud Security

Email Security

Threat Intelligence

Behavior Analytics

86 — Signature-Based Detection

Signature detection looks for known patterns.

Examples:

Known Malware Hash

Known Exploit Pattern

Known Network Signature

Advantages:

Precise
for Known Threats

Limitations:

Easy to Change

May Miss
Novel Behavior

87 — Behavior-Based Detection

Behavior detection looks for suspicious activity patterns.

Examples:

Office
Spawns PowerShell

Credential Dumping

Rapid Privilege Changes

Large Data Transfer

88 — Threshold Detection

Example:

More Than
20 Failed Logins

Within
5 Minutes

Thresholds should reflect:

Normal Behavior

Risk

Environment

89 — Correlation Detection

Example:

Failed Logins
      +
Successful Login
      +
New Admin Role

within:

15 Minutes

may generate a higher-confidence alert.

90 — Anomaly Detection

Anomaly detection identifies behavior different from established baselines.

Examples:

New Country

Unusual Login Time

Unusual Data Volume

New Device

Rare Process

91 — Anomaly Does Not Mean Malicious

Anomalous means:

Different

not:

Malicious

Context determines significance.

92 — Monitoring Baseline

A baseline describes expected behavior.

Examples:

Typical Login Locations

Normal Process Activity

Expected Network Volume

Standard Administrative Activity

93 — Monitoring Coverage

A mature SOC should understand:

What Are We
Monitoring?

and:

What Are We
Not Monitoring?

94 — Telemetry Coverage Matrix

Create a matrix:

Environment	Logging	Collection	Detection	Coverage
Windows Endpoints	Yes	Yes	Yes	Strong
Linux Servers	Yes	Partial	Partial	Medium
Cloud Accounts	Yes	Partial	Partial	Gap
SaaS Platform	Unknown	Unknown	No	Gap

95 — Common Monitoring Gaps

Examples:

Logging Disabled

Collector Failure

Unsupported Platform

New Cloud Account

Missing SaaS Integration

No Detection Rule

Insufficient Retention

Poor Parsing

96 — Detection Coverage Gap

Logs may be collected correctly.

But:

No Detection
Uses Them

This is a:

Detection
Coverage Gap

97 — Collection Gap

Logging exists on the source.

But:

SIEM Does Not
Receive It

This is a:

Collection Gap

98 — Logging Gap

The source does not generate the required event.

This is a:

Logging Gap

99 — Parsing Gap

Logs reach the SIEM.

But important fields are:

Not Parsed
Correctly

This can break detections.

100 — Monitoring Health

The SOC should monitor its own monitoring platform.

Questions:

Are Sources Reporting?

Are Collectors Healthy?

Is Ingestion Delayed?

Are APIs Failing?

Are Rules Running?

Is Storage Available?

101 — Source Heartbeat

A heartbeat confirms a data source is still reporting.

Example:

Cloud Account
Last Event:

3 Days Ago

This may indicate:

Collection Failure

102 — Ingestion Delay

Security data arriving:

4 Hours Late

may severely reduce detection value.

Real-time detection needs:

Timely
Telemetry

103 — Log Retention

Retention determines how long logs remain available.

Retention must support:

Investigation

Threat Hunting

Forensics

Compliance

Legal Requirements

104 — Retention Challenge

Suppose:

Compromise
Discovered
After 90 Days

but logs are retained for:

30 Days

the investigation may lose critical history.

105 — Hot vs Cold Storage

Security platforms may use:

Hot Storage
      ↓
Fast Search

Cold Storage
      ↓
Longer-Term Retention

Cost and performance must be balanced.

106 — Log Volume

Modern enterprises may generate:

Millions

or

Billions

of events.

Collecting everything without strategy can create:

Cost

Noise

Performance Problems

107 — Monitoring Strategy

Collect telemetry based on:

Threat Risk

Asset Criticality

Detection Requirements

Investigation Needs

Compliance Requirements

108 — High-Value Telemetry

Examples often include:

Authentication

Privilege Changes

Process Creation

Cloud API Activity

Network Connections

DNS

Security Alerts

109 — Monitoring Priority

Not every asset requires identical monitoring depth.

Prioritize:

Critical Systems

Privileged Accounts

Internet-Facing Assets

Sensitive Data Systems

Identity Infrastructure

110 — Asset Context

A process alert on:

Employee Laptop

may be lower priority than the same alert on:

Domain Controller

Asset context should enrich monitoring.

111 — User Context

Similarly:

Standard User

versus:

Global Administrator

changes investigation priority.

112 — Security Monitoring Architecture Example

                 USERS
                   ↓
             Identity Logs
                   │
                   │
Endpoints ─────────┤
Servers ───────────┤
Firewalls ─────────┤
DNS ───────────────┤
Cloud ─────────────┼→ Collection Layer
Applications ──────┤       ↓
Email ─────────────┤    Processing
SaaS ──────────────┘       ↓
                      Normalization
                           ↓
                       Enrichment
                           ↓
                          SIEM
                           ↓
                Detection / Correlation
                           ↓
                         Alerts
                           ↓
                         SOC

113 — Monitoring Questions

For every environment ask:

What Can Happen?

Which Logs
Would Show It?

Are Those Logs
Generated?

Are They Collected?

Are They Parsed?

Are They Searchable?

Do We Have
Detection Logic?

114 — Detection Use-Case Architecture

Example:

Threat:

Privileged Account
Compromise

Required telemetry:

Authentication

MFA

Privilege Changes

Cloud API

Endpoint

Detections:

Impossible Travel

Repeated MFA Denial

New Administrator

Unusual Cloud API

115 — Monitoring and MITRE ATT&CK

ATT&CK can help determine:

Which Telemetry
Is Needed
to Detect
Each Technique?

Example:

Technique:
PowerShell

Potential Telemetry:

Process Creation

PowerShell Logs

EDR

Command Line

116 — Monitoring Coverage by ATT&CK

A security team may create:

ATT&CK Technique
      ↓
Data Source
      ↓
Detection Rule
      ↓
Coverage Status

117 — Logging Does Not Equal Detection

Remember:

Telemetry
Collected
      ≠
Threat
Detected

You also need:

Detection Logic

118 — Detection Does Not Equal Investigation

Likewise:

Alert
Generated
      ≠
Threat
Confirmed

A human or automated investigation process must validate it.

119 — Monitoring Does Not Equal Security

Collecting billions of events does not automatically create:

Good Security

The real chain is:

Useful Telemetry
      ↓
Good Detection
      ↓
Effective Investigation
      ↓
Timely Response

120 — Monitoring Documentation

A SOC should maintain:

Log Source Inventory

Data Source Owners

Collection Method

Retention

Parsing Status

Detection Coverage

Health Status

121 — Build a Log Source Inventory

A useful structure:

Source ID	Source	Type	Owner	Collection	SIEM	Retention	Status
LOG-001	Identity Platform	Authentication	IAM	API	Yes	TBD	Active
LOG-002	Firewall	Network	Network	Syslog	Yes	TBD	Active
LOG-003	AWS	Cloud	Cloud	API	Partial	TBD	Gap

122 — Monitoring Ownership

Every source should have someone responsible for:

Logging Configuration

Collection

Availability

Changes

Without ownership, monitoring gaps can persist unnoticed.

123 — Change Management

Technology environments change constantly.

Examples:

New Cloud Account

New Application

New Firewall

New SaaS Platform

New Identity Provider

Security monitoring should be part of:

Change
Management

124 — New System Monitoring Checklist

When a new system is introduced:

Identify Logs

Enable Logging

Configure Forwarding

Validate Collection

Parse Fields

Apply Enrichment

Create Detections

Test Alerts

Monitor Health

125 — Security Monitoring Validation

Do not assume an integration works because:

Connector
Shows Green

Test:

Generate Event

Confirm Source Log

Confirm Collection

Confirm Parsed Fields

Confirm Search

Confirm Detection

126 — End-to-End Test

Example:

Generate
Failed Login
      ↓
Identity Platform
Records Event
      ↓
SIEM Receives Event
      ↓
Parser Extracts Fields
      ↓
Detection Matches
      ↓
Alert Generated

This validates the complete pipeline.

127 — Monitoring Failure Investigation

If the alert does not appear, identify:

Logging Failure?

Collection Failure?

Parsing Failure?

Rule Failure?

Alert Delivery Failure?

128 — Blue Team Monitoring Mindset

Do not ask only:

Do We
Have a SIEM?

Ask:

Do We Have
the Right Telemetry?

Is It Complete?

Is It Timely?

Can We Search It?

Can We Detect
Relevant Threats?

Can We Investigate
What Happened?

Practical Exercise 1 — Build a Log Source Inventory

Create a fictional enterprise containing:

Windows

Linux

Firewall

DNS

VPN

Identity

AWS

Email

Web Application

EDR

For each identify:

Source

Event Types

Collection Method

Security Value

Retention

Owner

Practical Exercise 2 — Design a SIEM Architecture

Draw:

Endpoints

Servers

Network

Identity

Cloud

Email

Applications
      ↓
Collection
      ↓
SIEM
      ↓
Detection
      ↓
SOC

Include:

Collectors

Parsing

Normalization

Enrichment

Alerting

Practical Exercise 3 — Monitoring Gap Analysis

Scenario:

10 AWS Accounts

Cloud Audit Logging:
10

SIEM Integration:
7

Identify:

Logging Coverage

Collection Coverage

Monitoring Gap

Risk

Recommended Action

Practical Exercise 4 — Identity Monitoring

Create detections for:

Repeated Failed Logins

Successful Login
after Failures

New Admin Role

MFA Disabled

MFA Fatigue

For each identify required telemetry.

Practical Exercise 5 — Endpoint Monitoring

Create a telemetry map for:

Process Execution

PowerShell

File Creation

Network Connection

Persistence

Identify which endpoint data could help investigate each activity.

Practical Exercise 6 — Network Monitoring

Build investigation questions for:

Suspicious Outbound
Connection

Use:

Firewall

DNS

Proxy

EDR

Threat Intelligence

Practical Exercise 7 — Cloud Monitoring

Scenario:

Storage Bucket
Made Public

Identify:

Which Cloud Log?

Which User?

Which API?

Which Resource?

Previous Configuration?

Subsequent Access?

Detection?

Practical Exercise 8 — Email Monitoring

Scenario:

User Receives
Suspicious Email

Identify telemetry from:

Email Gateway

Mailbox

Identity

Endpoint

Proxy

Practical Exercise 9 — Detection Pipeline Test

Design an end-to-end validation for:

Failed Authentication

covering:

Event Generation

Log Creation

Forwarding

Parsing

Detection

Alerting

Practical Exercise 10 — Build a Telemetry Coverage Matrix

Use:

Threat Activity	Required Telemetry	Collected?	Detection?	Gap
Credential Theft	Identity + Endpoint	Yes	Partial	Detection
Public Cloud Storage	Cloud Audit	Yes	Yes	None
Data Exfiltration	Proxy + Network	Partial	No	Coverage

Expand to:

15
Threat Activities

Knowledge Check

1. What is security monitoring?

2. Why is visibility important to the Blue Team?

3. What is a SIEM?

4. How is a SIEM different from basic log storage?

5. What are the main stages of a security telemetry pipeline?

6. What is log generation?

7. What is log collection?

8. What is agent-based collection?

9. What is agentless collection?

10. What is syslog?

11. Why are APIs important for modern monitoring?

12. What is parsing?

13. What is normalization?

14. What is enrichment?

15. What is correlation?

16. Why are accurate timestamps important?

17. What is NTP?

18. Why should SOC analysts understand time zones?

19. What can Windows security logs reveal?

20. Why is process creation telemetry important?

21. Why is PowerShell not automatically malicious?

22. What is Sysmon?

23. What types of Linux logs are useful to defenders?

24. What is EDR?

25. What is a process tree?

26. What is XDR?

27. Why is identity monitoring critical?

28. What is MFA fatigue?

29. What security activity should be monitored for privileged accounts?

30. What can firewall logs reveal?

31. Why are DNS logs valuable?

32. What can proxy logs reveal?

33. What is IDS?

34. What is IPS?

35. Why does an IDS alert not prove exploitation succeeded?

36. What is network flow data?

37. What is NDR?

38. Why is cloud audit logging important?

39. What cloud activities should be monitored?

40. What application events are security relevant?

41. Why are email logs important?

42. What is threat-intelligence enrichment?

43. What is signature-based detection?

44. What is behavior-based detection?

45. What is threshold detection?

46. What is anomaly detection?

47. Why does anomalous not mean malicious?

48. What is a logging gap?

49. What is a collection gap?

50. What is a detection gap?

51. What is a parsing gap?

52. Why should the SOC monitor telemetry source health?

53. What is log retention?

54. Why can short retention harm investigations?

55. Why should monitoring priorities consider asset criticality?

56. What is a telemetry coverage matrix?

57. Why should monitoring be included in change management?

58. What is an end-to-end monitoring test?

59. Why does collecting telemetry not guarantee detection?

60. What makes a security monitoring program effective?

Key Takeaways

Security monitoring follows:

System Activity
      ↓
Telemetry
      ↓
Collection
      ↓
Processing
      ↓
Normalization
      ↓
Enrichment
      ↓
Detection
      ↓
Alert
      ↓
Investigation

The SOC needs visibility across:

Identity

Endpoint

Network

Cloud

Application

Email

SaaS

Remember:

Logging Enabled
      ≠
Logs Collected

Logs Collected
      ≠
Logs Parsed

Logs Parsed
      ≠
Detection Exists

Detection Exists
      ≠
Threat Detected

Alert Generated
      ≠
Incident Confirmed

A mature monitoring program asks:

Can We See It?

Can We Search It?

Can We Detect It?

Can We Investigate It?

Can We Respond?

Career Connection

Security monitoring knowledge is essential for:

SOC Analysts

Blue Team Analysts

Security Analysts

Detection Engineers

Threat Hunters

Incident Responders

SOC Engineers

SIEM Engineers

During interviews, you should be able to explain:

How Logs Reach
a SIEM

What Normalization Means

How Correlation Works

Which Logs You Need
for Different Investigations

How You Identify
Monitoring Gaps

How You Validate
a Logging Pipeline

The key professional skill is not simply knowing:

Which SIEM
Button to Click

It is understanding:

Threat
      ↓
Required Telemetry
      ↓
Collection
      ↓
Detection
      ↓
Investigation

What’s Next?

➡️ Next: 03 — Threat Detection

You now understand where security telemetry comes from and how a SOC collects and monitors it.

The next step is learning how to transform that telemetry into:

Detections

In the next module, you will learn:

Detection Fundamentals

Detection Logic

Indicators of Compromise

Indicators of Attack

Behavior-Based Detection

Threshold Rules

Correlation Rules

Detection Use Cases

MITRE ATT&CK Mapping

Detection Coverage

False Positives

False Negatives

Detection Tuning

Detection Validation

Alert Prioritization

You will move from:

We Have
the Logs

to:

We Know
What Suspicious
Behavior to Detect

How to Detect It

and

How to Validate
the Detection

➡️ Next: 03 — Threat Detection