Dictionary · Defensive Security
Security Monitoring
Operations · Beginner
The ongoing practice of collecting signals and reviewing alerts so the team notices attacks, failures, and misuse in time to act.
A log that nobody reviews is storage, not monitoring. The practice includes what you collect, who looks, and what happens when an alert fires at 2 a.m.
Example: An on-call analyst triages high-severity alerts within 15 minutes and records the decision, even when the decision is to close it as benign.
Common misconception
- Installing a tool is not the practice. Monitoring includes people and a response path.