CISSP 17.3 - Logging & Monitoring (Part 2 of 2)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series continues logging and monitoring from Domain 7, turning raw logs into usable intelligence with the tools and techniques that scale. It covers how organizations tune their controls, centralize events, reduce data to what matters, and watch what leaves the network so real threats surface instead of drowning in noise.

Frequently Asked Questions

What are monitoring and tuning, and why are they continuous?

Monitoring is reviewing your logs to find something specific, by hand or with automated tools, so you catch malicious actions and failures. Tuning is adjusting your controls to fit your environment, and intrusion detection systems especially need it to cut false positives. Too sensitive, and endless alerts breed alert fatigue where analysts start ignoring warnings; not sensitive enough, and a real intrusion slips by. Both run continuously because your environment keeps changing, and monitoring must even watch production machine learning models for adversarial attacks and drift.

What does a security information and event management system do?

A SIEM is the central engine that automates monitoring across your whole network. Agents on remote systems watch for specific trigger events and report them to a central server, giving you real-time analysis, alerting, and long-term storage in one place. Its real power is correlation and aggregation, pulling data from many devices and converting it into meaningful information that spots patterns no single log would reveal, and modern versions even apply machine learning to surface what matters.

What are syslog, sampling, and clipping levels?

Syslog is a standard protocol for sending event notification messages to a central server, historically common on Unix and Linux. Sampling pulls a smaller set of data from a huge pool to represent the whole, and statistical sampling uses precise math that is reliable and defensible, though with some margin of error. A clipping level is nonstatistical sampling that reacts only once events cross a set threshold, such as alerting after five failed logins in half an hour, which is cheaper and simpler but misses anything under the line.

What other monitoring tools help, and what is log management?

Beyond logs, closed-circuit television records or watches events live and keeps guards accountable, keystroke monitoring records what a user types and usually requires notifying users first, and traffic and trend analysis studies packet flow rather than contents to flag oddities like an account blasting out huge amounts of email. Log management covers collecting, processing, and protecting log entries, aggregating them centrally, then cleaning up originals with techniques like rollover logging so logs never swallow your storage.

What is egress monitoring?

Egress monitoring watches traffic leaving your network, not just what comes in or moves around inside, and its purpose is catching unauthorized data leaving, known as data exfiltration. Data loss prevention tools lead here, spotting sensitive data and blocking its transmission and even reading digital watermarks. It also targets steganography, hiding messages inside files, which you detect by comparing hashes against a known-good original, and since attackers often encrypt data before sending it out, you monitor the volume, destination, and source of encrypted traffic even when you cannot read the contents.

Reference: This article is based on concepts discussed in CISSP 17.3 - Logging & Monitoring (Part 2 of 2).