{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://atlas.maintz.dev/)"},"id":"security/security-monitoring","url":{"en":"https://atlas.maintz.dev/en/terms/security/security-monitoring/","da":"https://atlas.maintz.dev/da/terms/security/security-monitoring/"},"term":{"en":"Security monitoring","da":"Sikkerhedsovervågning"},"aka":{"en":["continuous monitoring"],"da":["løbende overvågning"]},"domain":["security"],"cluster":"controls","layer":"governance","status":"current","summary":{"en":"Keeping a steady watch on systems and networks so that signs of attack or misuse are spotted while there is still time to act.","da":"Løbende at holde øje med systemer og netværk, så tegn på angreb eller misbrug opdages, mens der stadig er tid til at handle."},"body":{"formal":{"en":"The ongoing collection and review of logs, network traffic and device activity against expected behaviour, so that suspicious events are found, raised as alarms and handed on for response.","da":"Den løbende indsamling og gennemgang af logs, netværkstrafik og aktivitet på enheder holdt op mod forventet adfærd, så mistænkelige hændelser opdages, rejses som alarmer og sendes videre til håndtering."},"plain":{"en":"Like a night watchman walking the same rounds every hour - not to stop every break-in on the spot, but to notice the broken window before morning.","da":"Som en nattevagt, der går de samme runder hver time - ikke for at stoppe hvert indbrud på stedet, men for at opdage den knuste rude før morgenen."},"inPractice":{"en":"A water utility sends logs from its pump controls, website and firewall to one place, and the operations manager sets alarms for odd patterns, such as someone logging in to the pumps from outside at night.","da":"Et vandværk sender logs fra pumpestyringen, hjemmesiden og firewallen til ét sted, og driftslederen sætter alarmer op for usædvanlige mønstre, fx at nogen logger ind på pumperne udefra om natten."},"whyItMatters":{"en":"No defence stops everything, so the time between an attacker getting in and someone noticing decides how much harm is done.","da":"Intet forsvar stopper alt, så tiden fra en angriber kommer ind, til nogen opdager det, afgør, hvor stor skaden bliver."}},"deepDive":{"en":"The term covers two related scopes. In the narrow, operational sense it is threat detection: collecting telemetry and looking for evidence of attack. In the broader sense of NIST SP 800-137 (2011), information security continuous monitoring (ISCM) means maintaining ongoing awareness of vulnerabilities, threats and the effectiveness of controls to support risk decisions - patch levels, configuration compliance and control failures are monitored alongside intrusions. NIST CSF 2.0 reflects both in its Detect function, with categories DE.CM (continuous monitoring) and DE.AE (adverse event analysis), and ISO/IEC 27002:2022 added control 8.16 (monitoring activities) next to 8.15 (logging).\n\nData sources fall into three families. Logs: operating-system events (for example Windows Security events 4624/4625 for logon success and failure and 4688 for process creation, or Linux auditd and journald), identity-provider sign-in and audit logs, cloud control-plane logs (AWS CloudTrail, Azure Activity Log), application and database logs. Network data: flow records (NetFlow, IPFIX), DNS and proxy logs, IDS alerts and, where justified, full packet capture. Endpoint telemetry from EDR. Coverage is the first engineering problem - which assets and log types are actually collected - and time synchronisation is the second: without NTP-aligned clocks (ISO 27002 8.17), events cannot be correlated across systems.\n\nDetection content is written as use cases, increasingly mapped to MITRE ATT&CK techniques so that coverage gaps can be measured. David Bianco's Pyramid of Pain (2013) explains why behavioural detections are preferred over indicators: hashes and IP addresses are trivial for attackers to change, while tools and tactics are costly. Tuning is continuous; untuned rules produce alert fatigue, in which analysts learn to dismiss alerts and miss the real one. OT environments usually require passive monitoring, since active queries can disturb industrial controllers.\n\nEffectiveness is expressed in time. Dwell time - from initial compromise to detection - has fallen over the past decade but remains measured in days to weeks: Mandiant's M-Trends 2026 reports a global median of 14 days, up from 11 the year before, with much longer medians for espionage cases. Mean time to detect and mean time to respond are the usual internal metrics. Monitoring also has legal boundaries: monitoring employees' activity involves personal data, so in Denmark and the EU it must have a lawful basis, be proportionate and be disclosed to staff, and log retention must be justified. NIS2 Art. 21(2)(b) on incident handling and (f) on assessing the effectiveness of measures both presuppose monitoring, as does meeting the 24-hour early-warning deadline in Art. 23.","da":"Begrebet dækker to beslægtede omfang. I den snævre, operationelle betydning er det trusselsdetektion: indsamling af telemetri og søgning efter spor af angreb. I den bredere betydning i NIST SP 800-137 (2011) betyder information security continuous monitoring (ISCM) løbende indsigt i sårbarheder, trusler og kontrollernes effektivitet som grundlag for risikobeslutninger - patchniveauer, konfigurationsoverholdelse og kontrolsvigt overvåges sammen med indtrængen. NIST CSF 2.0 afspejler begge i funktionen Detect med kategorierne DE.CM (continuous monitoring) og DE.AE (adverse event analysis), og ISO/IEC 27002:2022 tilføjede kontrol 8.16 (overvågningsaktiviteter) ved siden af 8.15 (logning).\n\nDatakilderne falder i tre familier. Logs: hændelser fra styresystemet (fx Windows Security-hændelserne 4624/4625 for vellykket og mislykket logon og 4688 for procesoprettelse eller Linux auditd og journald), login- og auditlogs fra identitetsudbyderen, logs fra cloudens kontrolplan (AWS CloudTrail, Azure Activity Log) samt applikations- og databaselogs. Netværksdata: flowdata (NetFlow, IPFIX), DNS- og proxylogs, IDS-alarmer og, hvor det kan begrundes, fuld pakkeoptagelse. Endpoint-telemetri fra EDR. Dækningen er det første tekniske problem - hvilke aktiver og logtyper der faktisk indsamles - og tidssynkronisering det andet: uden NTP-afstemte ure (ISO 27002 8.17) kan hændelser ikke korreleres på tværs af systemer.\n\nDetektionsindholdet skrives som use cases, i stigende grad kortlagt til MITRE ATT&CK-teknikker, så huller i dækningen kan måles. David Biancos Pyramid of Pain (2013) forklarer, hvorfor adfærdsbaserede detektioner foretrækkes frem for indikatorer: hashværdier og IP-adresser er trivielle for angriberen at skifte, mens værktøjer og taktikker er dyre at ændre. Tuning er en løbende opgave; utunede regler giver alarmtræthed, hvor analytikerne vænner sig til at afvise alarmer og overser den rigtige. OT-miljøer kræver som regel passiv overvågning, fordi aktive forespørgsler kan forstyrre industrielle styringer.\n\nEffektiviteten udtrykkes i tid. Dwell time - fra første kompromittering til opdagelse - er faldet over det seneste årti, men måles stadig i dage til uger: Mandiants M-Trends 2026 angiver en global median på 14 dage, op fra 11 året før, og langt længere medianer for spionagesager. Mean time to detect og mean time to respond er de sædvanlige interne nøgletal. Overvågning har også juridiske grænser: overvågning af medarbejderes aktivitet indebærer behandling af personoplysninger, så den skal i Danmark og EU have et lovligt grundlag, være proportional og være oplyst over for medarbejderne, og opbevaringen af logs skal kunne begrundes. NIS2 art. 21, stk. 2, litra b om hændelseshåndtering og litra f om vurdering af foranstaltningernes effektivitet forudsætter begge overvågning, ligesom overholdelse af fristen på 24 timer for den tidlige varsling i art. 23 gør det."},"howTo":{"steps":{"en":["Write a monitoring strategy approved by management that says what is monitored and why - attacks and misuse, but also whether controls still work, such as patch levels and configuration drift.","Keep a coverage register of which assets and log types are collected, starting with internet-facing systems, identity, endpoints, email, cloud control planes and the central infrastructure, and mark the gaps.","Synchronise the clocks on all systems with NTP, so events from different sources can be put in the right order.","Before you monitor staff activity, document the lawful basis, check that it is proportionate, tell employees about it and set a retention period for the logs that you can justify.","Decide who watches the data and at what hours - your own SOC, an MSSP or an on-call rota - and how a finding is handed on to incident response.","In OT and industrial networks, use passive monitoring that listens to traffic without querying the controllers.","Alert when a log source goes silent, and check the coverage register every quarter against new systems and suppliers.","Measure how long it takes from an attack starting to someone noticing, and use incidents and exercises to find the blind spots that let it take longer."],"da":["Skriv en overvågningsstrategi, som ledelsen godkender, og som siger, hvad der overvåges og hvorfor - angreb og misbrug, men også om kontrollerne stadig virker, fx patchniveauer og ændringer i konfigurationen.","Før et register over dækningen, der viser, hvilke aktiver og logtyper der indsamles, begyndende med internetvendte systemer, identitet, endpoints, mail, cloudens kontrolplan og den centrale infrastruktur, og markér hullerne.","Synkronisér urene på alle systemer med NTP, så hændelser fra forskellige kilder kan sættes i den rigtige rækkefølge.","Før I overvåger medarbejdernes aktivitet, så dokumentér det lovlige grundlag, tjek, at det er proportionalt, oplys medarbejderne om det, og fastsæt en opbevaringsperiode for loggene, som I kan begrunde.","Beslut, hvem der holder øje med data og hvornår - jeres egen SOC, en MSSP eller en vagtordning - og hvordan et fund sendes videre til hændelseshåndteringen.","Brug passiv overvågning i OT- og industrinetværk, der lytter på trafikken uden at spørge styringerne.","Slå alarm, når en logkilde går tavs, og gennemgå registeret over dækningen hvert kvartal i lyset af nye systemer og leverandører.","Mål, hvor lang tid der går, fra et angreb begynder, til nogen opdager det, og brug hændelser og øvelser til at finde de blinde vinkler, der får tiden til at vokse."]},"pitfalls":{"en":["Collecting logs from everything except the systems attackers actually use, such as cloud admin portals and identity services.","Monitoring employees without a lawful basis or without telling them, which turns a security measure into a data protection breach.","Not noticing that a key log source stopped sending data weeks ago."],"da":["At indsamle logs fra alt andet end de systemer, angriberne faktisk bruger, fx administrationsportaler i skyen og identitetstjenester.","At overvåge medarbejdere uden et lovligt grundlag eller uden at fortælle dem det, så et sikkerhedstiltag bliver til et brud på databeskyttelsen.","Ikke at opdage, at en vigtig logkilde holdt op med at sende data for flere uger siden."]},"guides":[{"title":"NIST SP 800-137 - Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations","url":"https://csrc.nist.gov/pubs/sp/800/137/final","publisher":"NIST","tier":"standard"},{"title":"CIS Critical Security Control 13 - Network Monitoring and Defense","url":"https://www.cisecurity.org/controls/network-monitoring-and-defense","publisher":"Center for Internet Security","tier":"standard"},{"title":"Logning - en del af et godt cyberforsvar","url":"https://samsik.dk/publikationer/vejledning-logning/","publisher":"Styrelsen for Samfundssikkerhed","tier":"official-doc","lang":"da"},{"title":"Beskyt dig mod destruktive cyberangreb","url":"https://samsik.dk/cyb-publikationer/beskyt-dig-mod-destruktive-cyberangreb/","publisher":"Styrelsen for Samfundssikkerhed","tier":"official-doc","lang":"da"}]},"edges":[{"type":"requires","to":"cs/log","confidence":"high","strength":"normal"},{"type":"kind-of","to":"platform/monitoring","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/siem","why":{"en":"The SIEM is the usual tool that brings the watched data together and raises the alarms.","da":"SIEM'en er det typiske værktøj, der samler de overvågede data og slår alarm."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/soc","why":{"en":"The SOC is the team that does the watching and acts on what it finds.","da":"SOC'en er det team, der står for overvågningen og handler på det, den finder."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"ai/unsupervised-learning","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-137 - Information Security Continuous Monitoring (ISCM)","tier":"standard","publisher":"NIST"},{"title":"CIS Controls v8 - Control 8 (Audit Log Management) and Control 13 (Network Monitoring and Defense)","tier":"standard","publisher":"Center for Internet Security"},{"title":"M-Trends 2026: Data, Insights, and Strategies From the Frontlines","url":"https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026/","tier":"other","publisher":"Mandiant (Google Cloud)"}],"draft":true}