CompTIA Security+ SY0-701 · Free study guide

Objective 4.4 — Use monitoring and alerting capabilities effectively

Monitoring observes systems, applications, and infrastructure; alerting turns selected observations into action. The objective is timely, trustworthy response—not maximum event volume.

Log aggregation brings records into a searchable location. Preserve source, timestamp, time zone, host, identity, and correlation fields. Confirm that collection is complete and protected from unauthorized change. Archiving supports retention and later investigation, but long retention increases cost and sensitivity.

Scanning looks for defined conditions; reporting summarizes state; alerting signals a condition that needs review. Each alert should have an owner, severity logic, evidence, response procedure, and expected disposition. Quarantine can limit harm but may disrupt business, so automation needs confidence thresholds and recovery paths.

Tools and telemetry

A SIEM correlates and searches security events across sources. Endpoint antivirus detects known or suspicious malicious code; DLP observes or controls sensitive-data movement. Vulnerability scanners find weaknesses rather than active intrusion. NetFlow summarizes network conversations, while packet capture provides deeper content when collection is authorized. SNMP traps report device events. SCAP and benchmarks support standardized configuration and vulnerability content.

Agents can provide local context and operate away from the network but require deployment and maintenance. Agentless collection reduces installed components yet depends on credentials, protocols, and reachability. Choose based on evidence needs and validate coverage.

Tune without hiding risk

False positives waste attention; false negatives hide events. Tuning should narrow conditions using context, suppress known benign behavior with expiry, and test that true attack paths still alert. Never disable a noisy rule without identifying why it fires and what detection replaces it.

After response, validate remediation and detection. Did quarantine stop the activity? Did the clean host stop generating the indicator? Did the alert fire in the intended time? Use controlled tests and document changes.

Decision rule: select the source that can observe the behavior, preserve context, route a meaningful alert to an owner, and retest after tuning or remediation.