Security Monitoring: Logs, Alerts, and Baseline Behavior

What Is Security Monitoring?

Security monitoring is the continuous process of collecting, reviewing, and acting on data from systems and networks to detect threats, policy violations, and anomalies. Every device on a network—servers, firewalls, endpoints, and applications—generates records of its activity. These records are logs. When something in a log matches a rule or pattern that suggests trouble, the monitoring system raises an alert. Your job as a security analyst begins with understanding both.

Logs: The Raw Material of Detection

Logs are timestamped records of events. Common log sources include:

• Operating system logs – login attempts, privilege changes, service starts and stops (Linux: `/var/log/auth.log`, `/var/log/syslog`; Windows: Event Viewer)
• Network device logs – firewall accepts and denies, router activity
• Application logs – web server access, database queries, authentication events
• Security tool logs – antivirus detections, intrusion detection system (IDS) alerts

Logs follow formats. The syslog format is one of the oldest and most widely used on Linux and network devices. A syslog entry typically contains a priority value, timestamp, hostname, process name, process ID, and the message text. The ELK Stack (Elasticsearch, Logstash, Kibana) is a popular open-source platform that ingests logs from many sources, normalizes them, and makes them searchable through a web dashboard.

Log Forwarding

Logs generated on individual machines are only useful if analysts can see them in one place. Log forwarding sends log data from each source host to a central log collector (also called a SIEM collector or syslog server). Tools such as `syslog-ng` or Logstash act as the forwarding agent or collector. Centralizing logs prevents an attacker who compromises one machine from deleting local evidence, because copies already exist on the collector.

To verify that forwarding is working: check the collector's incoming log directory or dashboard, confirm the source IP matches the host you configured, and confirm the timestamp and format are as expected.

Baseline Behavior

A baseline is a documented picture of what normal looks like on a system or network—typical login times, expected outbound destinations, normal CPU and bandwidth usage. Without a baseline you cannot reliably distinguish anomalies from routine activity.

When you see events that deviate from baseline, treat them as candidates for investigation:

• Repeated failed logins – a single failed login is normal; dozens in seconds from the same IP suggests a brute-force attempt
• Unusual outbound connection times – connections leaving the network at 3 a.m. when no staff are working may indicate malware calling home (command-and-control, or C2)
• Privilege escalation commands – a standard user account running `sudo su` or accessing `/etc/shadow` without a documented reason is a red flag

Identifying Suspicious Events

When reviewing logs, work systematically:

1. Filter by time – look for clusters of events in short windows.

2. Filter by severity – many syslog events are informational; focus on `warning`, `error`, and `critical` levels first.

3. Cross-reference sources – a failed SSH login on a server followed by a successful login two minutes later from the same IP is more significant than either event alone.

4. Check for known indicators – repeated authentication failures, access to sensitive files, unexpected cron job additions, and outbound traffic to unusual ports are all common indicators of compromise (IoCs).

Annotate each suspicious entry with: what you saw, why it is suspicious, and what harm it could cause.

Writing a Structured Alert Summary

A structured alert summary turns your observation into an actionable document. It must include:

| Field | Purpose |

|---|---|

| Timestamp | Exact date and time from the log (include time zone) |

| Source | Hostname or IP address where the event originated |

| Event Description | Clear, factual description of what the log shows |

| Potential Impact | What could happen if this is a real attack |

| Recommended Next Step | The immediate action an analyst or responder should take |

Be specific and objective. Avoid guessing in the description field; save interpretation for the impact field.

Lab Safety and Responsible Use

All lab work takes place on isolated virtual machines provided for classroom use. Never forward traffic or test tools against systems you do not own or have explicit written permission to test. Unauthorized scanning or log manipulation of external systems violates the Computer Fraud and Abuse Act (CFAA) and institutional policy. Treat all pre-generated log files as confidential; they may contain simulated personal data. Follow your program's acceptable-use policy at all times.

Why This Matters for Your Credentials

CompTIA Security+ tests your understanding of log types, monitoring concepts, and incident response procedures. CompTIA CySA+ goes deeper, emphasizing threat and vulnerability analysis using log data and security tools. ISC2 CC covers foundational security operations including monitoring and alerting. Mastering log review is one of the most transferable, daily-use skills in this field.