Domain 5 · Objective reference 5.2 · Chapter 16 of 19
Security monitoring, triage, threat actors and intelligence
About 5 minutes · ISC2 CC outline effective 1 September 2026
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Positive means alert; true means the classification is correct.
Explore the anchors
Attack present and alert raised.
Concept matching activity
Match this task or description to its concept:
No attack but alert raised.
Choose a concept before checking the explanation.
Detection laboratory
Positive means the detector raised an alert. True/false compares that decision with known reality.
False negative — An attack exists. No alert was raised.
| Detector | Attack present | No attack |
|---|---|---|
| Alert | True positive | False positive |
| No alert | False negative | True negative |
Change the threshold
Eight fictional events have fixed known truth. An alert fires when the synthetic score is at least the threshold. The score is not a probability of attack.
TP 2 · FP 1 · FN 2 · TN 3. Precision 67%. Recall 50%.
Precision = TP ÷ (TP + FP). Recall = TP ÷ (TP + FN). Lower thresholds can increase detection and false alarms; this tiny dataset does not establish real-world performance.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Create usable event evidence
- Use context to prioritize and test hypotheses
Create usable event evidence
An event is an observed occurrence; an alert flags an observation for attention; an incident is handled according to the organization’s defined security criteria. Logs need relevant fields, timestamps, retention, access protection and reliable collection. Synchronization helps correlate events, but time sources and time zones still need interpretation. Excessive logging can expose secrets or overwhelm analysts, so collect data for defined detection and investigation needs.
A security-information and event-management capability can aggregate and correlate records. It needs functioning sources, use cases, review and escalation. A dashboard with no accountable response owner is incomplete. AI assistance can summarize or rank evidence, but the input quality, false positives, missed cases and human decision route remain important.
Use context to prioritize and test hypotheses
Triage considers affected assets, service importance, identity, reachability, confidence, related activity and potential consequences. An unusual payroll export may be a legitimate scheduled process or misuse; compare approved jobs, destinations and sign-in activity. Preserve evidence and escalate through the playbook rather than waiting for perfect certainty.
Threat actors can include financially motivated criminals, insiders, state-linked actors and opportunistic attackers. Motivation and capability inform hypotheses; they do not establish attribution from one indicator. Threat intelligence should be relevant, timely and evaluated for reliability. A threat-behavior framework organizes observed techniques, while a risk-management framework organizes different questions. A technique label or matching indicator is not proof of full detection coverage.
Worked example
A monitoring rule flags a large export. The analyst checks the service’s importance, job authorization, destination, account activity and related events, records uncertainty and follows the approved escalation route.
Check your understanding
What is wrong with treating a high-confidence AI alert as a confirmed incident with a named attacker?
Show explanation
The score is a model output under particular assumptions. Validate the evidence, incident criteria and any attribution claim separately; the model’s confidence is not independent proof.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.