In this section of the course,
we're going to be talking about Alerting and Monitoring.
Now, alerting and monitoring
are crucial components in security,
especially when it comes to maintaining the integrity,
confidentiality, and availability
of our information systems.
Alerting refers to the process
of notifying relevant personnel
when a potential security incident occurs.
And alerts can be generated by various security tools,
including our intrusion detection systems,
intrusion prevention systems,
security information event management systems,
and antivirus software.
Alerts can be categorized into four main types,
true positive false positive, true negative,
and false negative.
A true positive refers to an alert
that correctly identifies a legitimate issue or threat.
False positives are an alert that indicates incorrectly
the presence of a threat
or issue when there really isn't one there.
A true negative is good to note
that there is an absence of an alert
when there is indeed no issue or threat.
This means the system correctly recognized
that you are safe in this situation.
Now, a false negative, on the other hand,
is when the system fails to create an alert
when there is a real issue or threat there,
and essentially this means the system missed it
or overlooked that genuine problem.
And this is actually going to be a big problem for you
because now you have a threat
and you don't even realize it's there.
Now, the whole goal in effectively alerting our systems
is to maximize our true positives
while minimizing our false positives.
This way, we can avoid alert fatigue
among our security personnel
and make sure we're catching
all the bad things happening on our network.
Now, monitoring, on the other hand,
is going to involve the continuous observation
of a system or network to detect anomalies,
intrusions, and other potential security threats.
This is a proactive approach
to identifying and mitigating security incidents
before they can cause significant damage
to our systems or networks.
Monitoring can also be performed in several different ways.
It's usually going to be separate into two types,
automated monitoring and manual monitoring.
Automated monitoring is going to involve using software tools
to automatically scan and analyze our network logs,
our system logs, our network traffic,
and other data for signs of malicious activity.
Manual monitoring, on the other hand,
is going to use human personnel
to actively review and analyze our system data
to detect potential security issues.
Now, these monitoring systems
also incorporate alerting mechanisms
to notify security personnel
if a potential security incident was detected.
Now, in this section of the course,
we're going to be focused on domain 4,
and specifically objective 4.4.
Objective 4.4 states that you must be able to explain
security alerting and monitoring concepts and tools.
So, we'll begin by covering monitoring resources.
and here, we'll be doing an overview of monitoring systems,
applications, and infrastructure.
As we just mentioned, monitoring is an integral part
when it comes to maintaining the integrity,
confidentiality, and availability of our systems.
Next, we'll jump into a discussion
on alerting and monitoring activities,
and this includes log aggregation,
alerting, scanning, reporting,
archiving, and alert response and remediation or validation.
Then, we're going to be talking all about
the Simple Network Management Protocol known as SNMP.
Now, the Simple Network Management Protocol, or SNMP,
is a widely used protocol in network management systems
that's used for monitoring and managing network devices.
These devices can include things like routers,
and switches, and servers, and workstations,
and printers, and modems, and much more.
We're also going to spend a little bit of time here
discussing SNMP, SNMP traps,
and how they're used to set up and collect data.
After that, we're going to be discussing
the security information and event management system
known as a SIEM.
Now a SIEM is a set of integrated management technologies
that provides a holistic view
of your organization's information security.
By using a SIEM, we're going to be able to collectively
aggregate all of our log data
generated throughout the entire organization's network,
including all of its technology infrastructure
from its host systems and applications
all the way out to its network and security devices,
including things like firewalls and antivirus software.
Then, we're going to be able to take all that data together
and look through it to figure out what does it have
and what do we need to be alerting on
based on what we're seeing?
These SIEMs also are going to use
two different types of monitoring,
one is agent-based and the other is agentless monitoring,
and we'll talk about both of those.
Next, we're going to discuss data from security tools
and we'll be talking about the collection of data
from different sources like antivirus, DLP systems,
network intrusion detection systems,
network intrusion prevention systems,
firewalls and vulnerability scanners,
and how all this data can be consolidated within our SIEM
for us to be able to analyze and review.
Then, we'll take a look
at the Security Content Automation Protocol known as SCAP.
Now, the Security Content Automation Protocol
is a method to use for specific standards
to enable automated vulnerability management,
measurement, and policy compliance evaluation
of your systems that are deployed
across your organization's network.
After that, we're going to dive into network traffic flows.
Now, a network traffic flow,
often simply referred to as a flow,
is a sequence of packets from a source to a destination,
which may be identified by a unique set of identifiers,
like the source IP address,
the destination IP address, the source port number,
the destination port number, and the protocol being used.
Now, understanding traffic flows is really important.
And by analyzing these traffic flows,
you're going to be able to gain insights
into the patterns of network usage
and be able to identify bottlenecks or abnormalities
as well as assisting to detect potential security threats.
Next, we're going to cover a concept
known as the single pane of glass, or SPOG.
Now, a single pane of glass
is used in information technology management
to describe a system that consolidate data
from lots of different sources
into a completely unified display.
Our goal here is to provide our system administrators
with a comprehensive view of all the information
they need to make decisions to monitor the status
and to manage the operations of their networks.
And finally, we're going to take a short quiz
to see what you learned during this section of the course,
and review each of those quiz questions fully
to ensure you can explain each answer and why it was right.
So, let's start exploring the world
of alerting and monitoring in this section of the course.