Monitoring
The purpose of monitoring is to keep a watchful eye on network and system activities and scan constantly for any anomalies or suspicious behavior. Monitoring ensures that any deviations from the norm are swiftly detected and addressed. Monitoring logs, traffic patterns, and system behavior not only aids in threat detection but also alerts the security operations center. This section will take a look at two real-time monitoring systems (SIEM and SOAR), defined as follows:
- Security Information and Event Management (SIEM): SIEM systems operate in real time, centralizing and correlating logs from servers and network devices and capturing network traffic. Once these systems correlate the logs, they provide reports of threats to the security operations center, which can then take action to eradicate the attack.
- Security Orchestration, Automation, and Response (SOAR): SOAR works in real time to tackle threats. These systems use Artificial Intelligence (AI) and Machine...
