Security Operations: Logging, Monitoring, SIEM and Threat Intelligence

A log is a record of events that happened on a system: who logged in and when, which files were accessed, what network connections were opened, which processes ran, and what errors occurred. Almost every component in a modern environment produces logs, including servers, workstations, firewalls, routers, applications, databases, cloud services, and identity systems. Individually, each entry is a small fact. Together, logs are the organization's memory of what actually happened.

Monitoring is the act of reviewing that record continuously rather than only after something goes wrong. Without monitoring, an attacker can operate inside a network for weeks or months before anyone notices, because nothing is watching for the signs. With monitoring, unusual activity such as a login at 3 a.m. from an unfamiliar country, a sudden spike in outbound traffic, or repeated failed authentication attempts can be spotted while there is still time to respond.

Logs also serve purposes beyond detection. They support accountability, because actions can be traced back to specific accounts. They support troubleshooting, because administrators can reconstruct what a system did before it failed. They support compliance, because many laws and standards require organizations to keep and review security logs. And after an incident, logs become evidence that investigators use to determine scope and root cause.

For logs to be useful they must be protected. Attackers commonly try to delete or alter logs to cover their tracks, so good practice sends copies to a separate, centrally managed store that ordinary system administrators and attackers on a compromised host cannot modify. Time synchronization across systems matters too: if clocks disagree, events cannot be lined up into an accurate timeline.

Reading logs machine by machine does not scale. A mid-sized organization can generate millions of log entries per day, spread across hundreds of devices in different formats. Centralized logging solves this by forwarding logs from every source to one place, where they can be stored securely, retained for a defined period, and searched together.

The tool that sits at the center of this is the SIEM, short for Security Information and Event Management. A SIEM performs four core jobs:

• Aggregation: it collects log and event data from many different sources across the environment into a single platform.
• Normalization: it translates different vendor log formats into a common structure so events from a firewall and a Windows server can be compared side by side.
• Correlation: it applies rules and analytics to connect related events from different systems, revealing patterns that no single log would show.
• Alerting: when a rule matches, it raises an alert for a human analyst to investigate, and it provides dashboards and reports for ongoing visibility.

A SIEM does not stop attacks by itself. It is a detection and visibility tool: it turns scattered raw data into prioritized signals that people can act on. The SIEM is typically operated by the Security Operations Center, or SOC, the team (in-house or outsourced) responsible for monitoring alerts around the clock, investigating suspicious activity, and escalating confirmed incidents to the incident response process.

On the exam, if a question asks which tool collects and correlates security logs from across the enterprise and generates alerts, the answer is the SIEM.

A SIEM in a busy environment raises far more alerts than any team can fully investigate. Triage is the discipline of deciding, quickly and consistently, which alerts to work first. The word comes from emergency medicine, and the idea is the same: attend to the most serious cases before the minor ones.

Triage decisions rest on two main questions. First, how severe is the event: does it suggest a confirmed compromise, or just unusual but explainable behavior? Second, what is the potential impact: which asset is involved, how sensitive is the data on it, and how critical is it to the business? A malware alert on a server holding customer financial records outranks the same alert on an isolated test machine, even though the technical signature is identical. Prioritization by severity and impact ensures that limited analyst time goes where the risk is greatest.

To make triage repeatable, SOCs build incident use cases: predefined descriptions of the situations they care about, such as ransomware behavior, brute-force login attempts, data exfiltration, or malware on a critical server. Each use case defines what data sources feed it, what conditions trigger an alert, what priority it receives, and what the analyst should do next. Use cases turn monitoring from an open-ended watch into a set of specific, tested detections tied to real threats the organization faces.

The outcome of triage is a decision: dismiss the alert as a false positive, resolve it as a benign event, or escalate it as a possible incident for deeper investigation and response.

Correlation means linking related events, often from different systems, to see the real story behind them. Single events are usually ambiguous. One failed login is nothing. A new user account is routine. An outbound file transfer happens all day long. Correlation asks whether these small facts, viewed together, form a pattern that matters.

Consider a concrete scenario. At 02:10, the VPN log shows fifty failed login attempts against the account of a finance employee, followed by one success from an IP address in a country where the company has no staff. At 02:25, the domain controller logs show that same account creating a new administrator account. At 02:40, the firewall records a large encrypted upload from a finance file server to an unknown external host. Each event, alone, might be triaged as low priority. Correlated into one timeline, they describe a credential-stuffing attack, privilege escalation, and data exfiltration in progress, which is a critical incident demanding immediate response.

Correlation also works in the other direction: it reduces false positives. A false positive is an alert that fires when nothing malicious actually happened, and high false-positive volume is the enemy of a SOC, because it buries real attacks in noise and causes alert fatigue in analysts. By requiring multiple independent signals before raising a high-priority alert, correlation rules filter out the one-off anomalies that have innocent explanations, so the alerts that do fire are far more likely to be real.

This is why the SIEM's correlation capability, not just its storage capacity, is what makes centralized logging genuinely useful for detection.

A threat actor is an individual or group that carries out, or intends to carry out, harmful activity against systems and data. Knowing who might attack you, and why, shapes what you monitor for and how you prioritize defenses. The CC exam expects you to recognize the common types and match each to its typical motivation.

Two nuances are worth remembering. First, insiders are especially dangerous not because they are the most skilled, but because they already have authorized access, so many perimeter defenses never see them. Second, an APT is defined by persistence and stealth: the goal is long-term, undetected presence, usually for espionage, rather than a quick smash-and-grab.

Exam questions often describe behavior and ask you to name the actor. Well-funded, patient, targeting government secrets points to a nation-state APT. Demanding ransom points to organized crime. Defacing a website over a policy dispute points to a hacktivist.

Cyber threat intelligence is the practice of collecting data about adversaries and their methods, analyzing it in the context of your own organization, and turning it into actionable knowledge that improves decisions. The key word is actionable: a raw feed of ten thousand malicious IP addresses is data; the conclusion that a ransomware group is actively targeting your industry through phishing, and that you should tighten email defenses and watch for specific indicators, is intelligence.

CTI is commonly described at three levels, which differ in audience and time horizon:

Intelligence comes from many sources: open-source reporting, commercial feeds, government advisories, and information-sharing communities where organizations in the same sector exchange what they are seeing. Inside the SOC, tactical intelligence feeds detection directly, because indicators of compromise become SIEM correlation rules and blocklists, while operational and strategic intelligence guide which use cases to build and where to invest.

For the exam, remember the direction of the process: CTI transforms data about threats into knowledge you can act on, and the three levels are distinguished by who consumes them and how immediate they are.

Frameworks give defenders a shared, structured vocabulary for describing how attacks unfold. The CC exam tests these at recognition depth: you need to know what each framework is and what it organizes, not memorize its full contents.

MITRE ATT&CK is a publicly available knowledge base of real-world adversary behavior. It is organized as a matrix of tactics and techniques. A tactic is the attacker's goal at a stage of the operation, the why, such as initial access, privilege escalation, or exfiltration. A technique is a specific method used to achieve that goal, the how, such as phishing to gain initial access or credential dumping to escalate privileges. Security teams use ATT&CK to describe incidents precisely, to check which techniques their monitoring can detect, and to map threat intelligence about specific adversary groups to concrete defenses.

The Cyber Kill Chain, developed by Lockheed Martin, models an intrusion as a linear sequence of stages the attacker must complete:

1. Reconnaissance: researching and selecting the target
2. Weaponization: preparing the malicious payload
3. Delivery: transmitting it to the victim, for example by phishing email
4. Exploitation: triggering a vulnerability to run attacker code
5. Installation: establishing persistent access, such as installing malware
6. Command and control: opening a channel for remote control
7. Actions on objectives: achieving the goal, such as stealing or destroying data

The defensive insight of the kill chain is that breaking any single link stops the attack: blocking the phishing email at delivery, or the malware at installation, defeats the whole chain. In practice, ATT&CK offers finer-grained, behavior-level detail, while the kill chain offers a simple end-to-end narrative; SOCs use both to classify what they observe and find gaps in their detection coverage.