5 Security Monitoring and Detection Free Online FlashCards

What is security telemetry?

Telemetry is data produced by systems and security controls that describes their state or activity.

What does a security log record?

Logs are records of events, such as a sign-in, a process starting, or a firewall blocking traffic.

How should an organization choose telemetry sources?

Choose sources according to important assets, likely threats, and investigation needs; collecting everything can add cost and noise, while collecting too little can leave gaps.

What happens during log normalization and enrichment?

Normalization converts records into consistent fields; enrichment adds useful context, such as asset owner, system criticality, or account type.

What safeguards matter when transmitting logs?

Forward records to an authorized, centrally managed collection service, protect them in transit, and monitor whether sources stop sending.

Why are reliable timestamps essential to log analysis?

Synchronize system clocks and retain time-zone information where relevant; otherwise, events may appear in the wrong order.

What should monitoring of the logging pipeline detect?

Check for missing sources, delays, parsing errors, and unexpected volume changes. A lack of events may indicate a lull, a broken sensor, disabled logging, or tampering.

What is log correlation?

Correlation links records from multiple sources using shared details such as time, account, device, IP address, or event identifier.

Why establish an activity baseline?

Establish a baseline of ordinary activity for users, systems, and services so unusual or risky behavior can be recognized.

What login pattern may warrant investigation?

Repeated failures followed by a successful sign-in from an unfamiliar location may warrant investigation, especially when considered with context.

What information should a useful alert provide?

A useful alert explains what happened, why it matters, which entities are affected, what evidence supports it, and what to do next.

Which factors should guide alert prioritization?

Prioritize by confidence, potential impact, asset criticality, scope, and urgency—not merely by event count.