Security Monitoring & Logging

What it is

Security monitoring is the ongoing collection and analysis of logs and events to detect malicious activity — the detective counterpart to preventive controls like firewalls and access control.

Key points

• What to log: authentication events (especially failures), privilege changes, access to sensitive data, and network flow data — logging everything indiscriminately drowns out signal.
• SIEM (Security Information and Event Management) tools aggregate logs from many sources and correlate them to surface patterns a single log source wouldn't reveal.
• Detective vs. preventive controls: monitoring detects and alerts after the fact; it doesn't stop an attack by itself — it needs to be paired with an actual response process.
• Alert fatigue is the main practical failure mode — too many low-signal alerts trains responders to ignore them, which is why tuning and prioritization matter as much as coverage.