Security monitoring
Also known as: continuous monitoring
Keeping a steady watch on systems and networks so that signs of attack or misuse are spotted while there is still time to act.
Draft - this entry has not been reviewed yet.
Formal
The ongoing collection and review of logs, network traffic and device activity against expected behaviour, so that suspicious events are found, raised as alarms and handed on for response.
In plain English
Like a night watchman walking the same rounds every hour - not to stop every break-in on the spot, but to notice the broken window before morning.
In practice
A water utility sends logs from its pump controls, website and firewall to one place, and the operations manager sets alarms for odd patterns, such as someone logging in to the pumps from outside at night.
Why it matters
No defence stops everything, so the time between an attacker getting in and someone noticing decides how much harm is done.
How to put it into practice
The usual steps, in order. Adapt them to your organisation.
- Write a monitoring strategy approved by management that says what is monitored and why - attacks and misuse, but also whether controls still work, such as patch levels and configuration drift.
- Keep a coverage register of which assets and log types are collected, starting with internet-facing systems, identity, endpoints, email, cloud control planes and the central infrastructure, and mark the gaps.
- Synchronise the clocks on all systems with NTP, so events from different sources can be put in the right order.
- Before you monitor staff activity, document the lawful basis, check that it is proportionate, tell employees about it and set a retention period for the logs that you can justify.
- Decide who watches the data and at what hours - your own SOC, an MSSP or an on-call rota - and how a finding is handed on to incident response.
- In OT and industrial networks, use passive monitoring that listens to traffic without querying the controllers.
- Alert when a log source goes silent, and check the coverage register every quarter against new systems and suppliers.
- Measure how long it takes from an attack starting to someone noticing, and use incidents and exercises to find the blind spots that let it take longer.
Common pitfalls
- Collecting logs from everything except the systems attackers actually use, such as cloud admin portals and identity services.
- Monitoring employees without a lawful basis or without telling them, which turns a security measure into a data protection breach.
- Not noticing that a key log source stopped sending data weeks ago.
Good guides
- NIST SP 800-137 - Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations(opens in a new tab) · NIST
- CIS Critical Security Control 13 - Network Monitoring and Defense(opens in a new tab) · Center for Internet Security
- Logning - en del af et godt cyberforsvar(opens in a new tab) · Styrelsen for Samfundssikkerhed (in Danish)
- Beskyt dig mod destruktive cyberangreb(opens in a new tab) · Styrelsen for Samfundssikkerhed (in Danish)
Technical deep dive
The term covers two related scopes. In the narrow, operational sense it is threat detection: collecting telemetry and looking for evidence of attack. In the broader sense of NIST SP 800-137 (2011), information security continuous monitoring (ISCM) means maintaining ongoing awareness of vulnerabilities, threats and the effectiveness of controls to support risk decisions - patch levels, configuration compliance and control failures are monitored alongside intrusions. NIST CSF 2.0 reflects both in its Detect function, with categories DE.CM (continuous monitoring) and DE.AE (adverse event analysis), and ISO/IEC 27002:2022 added control 8.16 (monitoring activities) next to 8.15 (logging).
Data sources fall into three families. Logs: operating-system events (for example Windows Security events 4624/4625 for logon success and failure and 4688 for process creation, or Linux auditd and journald), identity-provider sign-in and audit logs, cloud control-plane logs (AWS CloudTrail, Azure Activity Log), application and database logs. Network data: flow records (NetFlow, IPFIX), DNS and proxy logs, IDS alerts and, where justified, full packet capture. Endpoint telemetry from EDR. Coverage is the first engineering problem - which assets and log types are actually collected - and time synchronisation is the second: without NTP-aligned clocks (ISO 27002 8.17), events cannot be correlated across systems.
Detection content is written as use cases, increasingly mapped to MITRE ATT&CK techniques so that coverage gaps can be measured. David Bianco's Pyramid of Pain (2013) explains why behavioural detections are preferred over indicators: hashes and IP addresses are trivial for attackers to change, while tools and tactics are costly. Tuning is continuous; untuned rules produce alert fatigue, in which analysts learn to dismiss alerts and miss the real one. OT environments usually require passive monitoring, since active queries can disturb industrial controllers.
Effectiveness is expressed in time. Dwell time - from initial compromise to detection - has fallen over the past decade but remains measured in days to weeks: Mandiant's M-Trends 2026 reports a global median of 14 days, up from 11 the year before, with much longer medians for espionage cases. Mean time to detect and mean time to respond are the usual internal metrics. Monitoring also has legal boundaries: monitoring employees' activity involves personal data, so in Denmark and the EU it must have a lawful basis, be proportionate and be disclosed to staff, and log retention must be justified. NIS2 Art. 21(2)(b) on incident handling and (f) on assessing the effectiveness of measures both presuppose monitoring, as does meeting the 24-hour early-warning deadline in Art. 23.
What to learn first
Everything this builds on, foundations first.
- Log
- →Security monitoring
Relationships
- A kind of
- Monitoring
- Requires
- Log
Sources & further reading
Standards & official texts
- NIST SP 800-137 - Information Security Continuous Monitoring (ISCM) · NIST
- CIS Controls v8 - Control 8 (Audit Log Management) and Control 13 (Network Monitoring and Defense) · Center for Internet Security
Course material
- Cyber Security Fast Track - Ordliste
Other
- M-Trends 2026: Data, Insights, and Strategies From the Frontlines · Mandiant (Google Cloud)
Where this data comes from
This entry was drafted by an AI from the sources above and has not yet been checked by a person. Treat it as a starting point, and check anything important against the sources.
See the review queueSuggest a correction on GitHubThis term as JSON
Check yourself
Loading…