How do I notice that something is wrong?
Monitoring.
What you cannot see, you cannot protect. How monitoring makes attacks visible early.
2 types of monitoring.#
Operational monitoring
Is everything running? Servers, services, certificates, storage and lines are monitored for availability and performance.
Security monitoring
Is something suspicious? Sign-ins, network traffic and behaviour are checked for signs of attacks.
Both together
An unusual outage can be an attack, and an attack often first shows up as a performance problem.
6 data sources.#
Good monitoring looks at several places at the same time.
Endpoints and servers
EDR reports suspicious processes, file changes and encryption attempts.
Network
Firewall logs, flow data and NDR show unusual connections and data outflows.
Identities
Sign-ins, permission changes and unusual access are often the first warning sign.
Cloud and applications
Audit logs show configuration changes and access to data.
Infrastructure
Availability, load, certificate expiry and environmental sensors in the server room.
OT, IoT and buildings
Passive observation of facilities, cameras and access systems without disturbing them.
From event to incident.#
Millions of raw data points become a few cases that really count.
Collect
Bring together logs and telemetry from all sources.
Correlate
A SIEM links events that seem harmless on their own.
Detect
Rules, anomaly detection and threat intelligence raise the alarm.
Assess
Analysts sort by risk and rule out false alarms.
Respond
Playbooks, escalation and automatic containment if needed.
Own SOC or service?#
3 operating models compared.
| Own SOC | SOC or MDR as a service | Hybrid | |
|---|---|---|---|
| Effort | High: team, tools, processes | Low: provider runs platform and team | Medium: tasks are shared |
| Around the clock | Only with several shifts, expensive | Usually included | Service at night, in-house during the day |
| Knowledge | Must be built up and retained in-house | Broad specialist knowledge available | Internal knowledge plus external depth |
| Control | Maximum | By contract and through reports | Shared |
| Suitable for | Large organisations with high risk | SMEs and small IT teams | Growing organisations |
How to recognise quality.#
MTTD: time to detect
How long does it take on average before an attack is noticed? The shorter, the better.
MTTR: time to respond
How quickly is it contained and recovered?
Coverage
What share of systems, accounts and sites is connected?
False alarm rate
Too many false alarms lead to alert fatigue, and real hits get lost.
Retention
How long are logs available, and are they tamper-proof?
Exercise results
Are test attacks detected? That proves effectiveness.
Monitoring and data protection
Monitoring processes personal data, such as sign-ins and usage behaviour. Purpose, scope, access and retention must be regulated, in companies often with the works council in a works agreement.
Check: monitoring.#
6 questions about your monitoring.
Rough guidance, not an audit. Your selection stays in your browser.
Frequently asked questions.#
Is an antivirus scanner enough?
It detects known malware, but not attacks that behave like normal use. EDR and central analysis close this gap.
How long should logs be kept?
There is no blanket number. Purpose, risk, requirements and data protection are decisive. Set the duration deliberately and document it.
What is the difference between SIEM and XDR?
A SIEM collects and correlates logs from any source. XDR brings closely integrated detection and response from endpoints, email, network and cloud. The two are often combined.
Can I build monitoring myself?
Technically yes, even with open tools. The effort lies in operation: maintaining rules, assessing alerts and being reachable around the clock.
Planning monitoring?
Tell me what you want to monitor, and we will add to the content.