Security monitoring basics: logs, detections and triage

Skills you'll practise

• Choose which log sources to collect first and explain why
• Explain normalization, time synchronization and retention, and spot a time-zone mistake in a timeline
• Recognize a log source that has stopped sending and treat it as an issue
• Distinguish threshold, correlation and anomaly detections, and tune a noisy rule with a narrow, documented exception
• Triage an alert: validate, scope, enrich, decide and document, escalating per the playbook

Course outline

1. 1.Security monitoring basicsVideo · 2 min
2. 2.Logs worth collectingLesson · 15 min
3. 3.Searching and detectionsLesson · 15 min
4. 4.Triage, documentation and escalationLesson · 15 min
5. 5.Security monitoring basics: logs, detections and triage: knowledge checkKnowledge check · 16 questions
6. 6.Final exam9 questions · passing it completes the course, so people who already know the material can test out

Sources it draws on

The lessons and questions are written from these references, so learners can go back to the original.

• NIST SP 800-92: Guide to Computer Security Log Management
• NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
• ACSC, CISA and partners: Best practices for event logging and threat detection (logging policy, centralized collection and correlation, secure storage and integrity, threat-focused detection, timestamp consistency)
• CIS Critical Security Controls v8.1, Control 8: Audit Log Management (collect, alert, review and retain audit logs)
• General security operations (SOC) practice