Domain 7 · Objective reference 7.2 · Chapter 44 of 62
Operate logging, monitoring and threat analysis
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: An alert is a lead not a verdict.
Explore the anchors
Acquire useful time-aligned observations.
Concept matching activity
Match this task or description to its concept:
Relate events and known context.
Choose a concept before checking the explanation.
Detection laboratory
Positive means the detector raised an alert. True/false compares that decision with known reality.
False negative — An attack exists. No alert was raised.
| Detector | Attack present | No attack |
|---|---|---|
| Alert | True positive | False positive |
| No alert | False negative | True negative |
Change the threshold
Eight fictional events have fixed known truth. An alert fires when the synthetic score is at least the threshold. The score is not a probability of attack.
TP 2 · FP 1 · FN 2 · TN 3. Precision 67%. Recall 50%.
Precision = TP ÷ (TP + FP). Recall = TP ÷ (TP + FN). Lower thresholds can increase detection and false alarms; this tiny dataset does not establish real-world performance.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
- Tune telemetry without losing the denominator
Concepts and mechanisms
Monitoring needs relevant sources, reliable delivery, time alignment, retention, access protection and an accountable response. SIEM capabilities aggregate and correlate; intrusion detection and prevention provide different actions; behavior analytics seeks deviations but can produce false positives. Threat feeds and hunting hypotheses need relevance and reliability, not automatic acceptance of every indicator.
Design, evidence and tradeoffs
Tune rules against meaningful benign and adversarial conditions, track telemetry gaps and test the handoff from observation to action. Egress monitoring can reveal unusual outbound activity, but encryption and endpoint context affect visibility. AI tools can assist triage while still needing evidence validation, privacy limits and human authority. A missing central alert can result from a disconnected source rather than poor rule logic.
Tune telemetry without losing the denominator
SIEM correlates selected logs; UEBA analyzes behavioral signals for users and entities. Threat intelligence provides context and hypotheses, while threat hunting seeks evidence of a defined behavior. Egress monitoring examines outbound movement and can reveal exposures that ingress-only monitoring misses. Maintain trustworthy timestamps, source coverage, retention and access. Tune rules using false positives and false negatives, not just alert volume. A quiet dashboard can mean reduced attacks, missing telemetry or an overly strict threshold; validate which explanation the evidence supports.
Worked example
A detection exercise confirms endpoint evidence but no central event; the team repairs forwarding and retests the complete workflow.
Check your understanding
Why does rule count not establish detection coverage?
Show explanation
Coverage depends on relevant telemetry, correct logic, validation, false-positive behavior and the response process for specified scenarios.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.