Security monitoring

The term covers two related scopes. In the narrow, operational sense it is threat detection: collecting telemetry and looking for evidence of attack. In the broader sense of NIST SP 800-137 (2011), information security continuous monitoring (ISCM) means maintaining ongoing awareness of vulnerabilities, threats and the effectiveness of controls to support risk decisions - patch levels, configuration compliance and control failures are monitored alongside intrusions. NIST CSF 2.0 reflects both in its Detect function, with categories DE.CM (continuous monitoring) and DE.AE (adverse event analysis), and ISO/IEC 27002:2022 added control 8.16 (monitoring activities) next to 8.15 (logging).

Data sources fall into three families. Logs: operating-system events (for example Windows Security events 4624/4625 for logon success and failure and 4688 for process creation, or Linux auditd and journald), identity-provider sign-in and audit logs, cloud control-plane logs (AWS CloudTrail, Azure Activity Log), application and database logs. Network data: flow records (NetFlow, IPFIX), DNS and proxy logs, IDS alerts and, where justified, full packet capture. Endpoint telemetry from EDR. Coverage is the first engineering problem - which assets and log types are actually collected - and time synchronisation is the second: without NTP-aligned clocks (ISO 27002 8.17), events cannot be correlated across systems.

Detection content is written as use cases, increasingly mapped to MITRE ATT&CK techniques so that coverage gaps can be measured. David Bianco's Pyramid of Pain (2013) explains why behavioural detections are preferred over indicators: hashes and IP addresses are trivial for attackers to change, while tools and tactics are costly. Tuning is continuous; untuned rules produce alert fatigue, in which analysts learn to dismiss alerts and miss the real one. OT environments usually require passive monitoring, since active queries can disturb industrial controllers.

Effectiveness is expressed in time. Dwell time - from initial compromise to detection - has fallen over the past decade but remains measured in days to weeks: Mandiant's M-Trends 2026 reports a global median of 14 days, up from 11 the year before, with much longer medians for espionage cases. Mean time to detect and mean time to respond are the usual internal metrics. Monitoring also has legal boundaries: monitoring employees' activity involves personal data, so in Denmark and the EU it must have a lawful basis, be proportionate and be disclosed to staff, and log retention must be justified. NIS2 Art. 21(2)(b) on incident handling and (f) on assessing the effectiveness of measures both presuppose monitoring, as does meeting the 24-hour early-warning deadline in Art. 23.