Objective 4.4: Explain security alerting and monitoring concepts and tools

Cert: CompTIA Security+ (SY0-701) Domain: 4.0 Security Operations Weight: ~28% of SY0-701 (Domain 4 total) Depth: Explain. Be able to read an alert, name the right tool, classify the alert correctly, and decide the next action. Plain-English fluency over rote memorization.

What this objective tests

You should be able to explain what monitoring covers (systems, applications, infrastructure), name the six monitoring activities (log aggregation, alerting, scanning, reporting, archiving, alert response), describe the standard SOC toolkit (SIEM, antivirus, EDR, DLP, SNMP traps, NetFlow, vulnerability scanners, SCAP-based compliance scanners), and walk the alert response loop (triage, validate, remediate, validate, document, tune). This is the day-in-the-life objective for a Tier 1 SOC analyst, and CompTIA wrote it to mirror the actual interview questions for that seat. NIST SP 800-92 (log management), NIST SP 800-137 (continuous monitoring), and NIST SP 800-94 (intrusion detection and prevention) anchor the underlying concepts.

Key facts

What is being monitored

Three layers. A mature SOC sees all three; a weak SOC sees one and assumes the rest is fine.

• Systems. Operating systems on servers and endpoints. Windows, Linux, macOS, Chromebook fleet, mobile devices.
• Applications. Business software running on those systems: ERP, CRM, custom apps, SaaS platforms (Microsoft 365, Salesforce, Google Workspace), database engines, web servers.
• Infrastructure. Everything between: firewalls, switches, routers, wireless controllers, cloud control planes (AWS, Azure, GCP), identity providers (Azure AD, Okta), VPN concentrators, container orchestrators.

Each layer produces logs and metrics. The SIEM brings them together. Coverage gaps are how attackers stay invisible. A monitored endpoint with an unmonitored cloud identity provider next to it still leaves the front door open.

The six monitoring activities (SP-4.4 testable list)

SY0-701 names six activities. They form a lifecycle. Skip one and the others lose value.

NIST SP 800-92 (Guide to Computer Security Log Management) calls the log lifecycle "generate, transport, store, analyze, dispose." That maps cleanly onto the first five items. The sixth (alert response) is what makes the data worth collecting in the first place.

The standard monitoring toolkit (SP-4.4 testable list)

#### SCAP and benchmarks

• SCAP (Security Content Automation Protocol). NIST SP 800-126 standard. Lets compliance scanners read benchmark content and report findings in a structured, machine-readable format. Versions 1.2 and 1.3 are in active use; SP 800-126 Rev 3 is the current spec.
• Benchmarks. Documented secure baselines. The two you will see most:
• CIS Benchmarks (Center for Internet Security) for Windows, Linux, AWS, Azure, GCP, Kubernetes, browsers, databases. Two levels: Level 1 (basic, broadly compatible) and Level 2 (hardened, may break some workloads).
• STIGs (Security Technical Implementation Guides) from DISA for federal systems. Stricter than CIS in many places.

SCAP is the protocol. CIS and DISA write the content. The scanner reads the content and produces a report.

#### Agent-based vs agentless

Most enterprise SOCs run both. EDR is always an agent. Cloud control plane monitoring is always agentless (API-driven). Network device monitoring is usually SNMP-based and agentless. Compliance scans against servers can be either, depending on the product.

#### SIEM (Security Information and Event Management)

Central platform for log aggregation, correlation, alerting, reporting, and archiving. Reads logs from every source, normalizes the format, applies detection rules, fires alerts. Common platforms: Splunk, Microsoft Sentinel, Elastic Security, IBM QRadar, Google Chronicle (SecOps), Sumo Logic, LogRhythm. A SIEM is a platform; the detection content (rules, dashboards, playbooks) is the actual work and must be funded as a continuous activity, not a one-time install.

#### Antivirus and EDR

• Antivirus blocks known malware by signature. Still required (compliance frameworks expect it), still useful as a fast first filter on known bad. Foundational, not sufficient.
• EDR (Endpoint Detection and Response) is the modern evolution. Watches behavior, not just signatures: process trees, registry changes, network calls, parent-child relationships. Can quarantine the host, kill processes, and let the SOC investigate a live endpoint over the network. Common products: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Sophos, Carbon Black, Cortex XDR.

Modern endpoint stacks pair EDR with a signature-based AV engine, not one or the other.

#### DLP (Data Loss Prevention)

Watches data in use, in motion, and at rest. Blocks or alerts when sensitive data is at risk of leaving the environment. Detection methods include regex pattern matching (credit card numbers, SSNs), data classification labels (Microsoft Information Protection, Titus), document fingerprints, and exact data match. Common channels: corporate email, web upload, USB drives, cloud storage sync, instant messaging. The classic DLP failure mode is over-blocking lawful business use, which drives users to shadow IT workarounds. Tuning matters as much as the technology.

#### SNMP traps and NetFlow

• SNMP trap. Unsolicited message a network device sends to a monitor when a defined event occurs (link down, fan failure, CPU threshold crossed, authentication failure, configuration change). Lightweight, asynchronous, decades old. Net+ background helps here.
• NetFlow. Network device feature that exports records describing flows of traffic. Each record contains source IP, destination IP, source port, destination port, protocol, byte count, packet count, and duration. Lets the SOC see east-west and north-south traffic at scale without storing every packet. Variants: NetFlow v5/v9 (Cisco original), IPFIX (IETF standard), sFlow (sampled flow, vendor-neutral).

NetFlow plus SIEM correlation is how a SOC catches data exfiltration when the endpoint EDR misses it.

#### Vulnerability scanners

Probe hosts and applications for known weaknesses. Findings: missing patches, weak configurations, exposed services, default credentials, end-of-life software. Outputs: a list keyed by CVE (Common Vulnerabilities and Exposures) with CVSS (Common Vulnerability Scoring System) severity scores. Common scanners: Nessus, Qualys VMDR, OpenVAS, Rapid7 InsightVM, Microsoft Defender Vulnerability Management. Pairs directly with SP-4.3 vulnerability management: the scanner finds, the team prioritizes, IT remediates, and the next scan validates.

Alert response loop

Every alert closes the same way: triage, validate, remediate, validate again, document.

1. Triage. Read the alert. See what rule fired. Pull the related logs. Check the host or account in EDR and identity logs.
2. Validate. Is this real or noise. Look at the user's normal behavior, the host's baseline, recent change activity, time of day, and any related alerts.
3. Remediate. If real, contain the threat: quarantine the host in EDR, kill the process, block the destination IP at the firewall, reset the user account, page on-call.
4. Validate again. Confirm the action worked: outbound connections dropped, the suspicious process is gone, the account password reset took. Re-check the SIEM for follow-on activity.
5. Document. Write the ticket entry: what happened, what you did, what you ruled out, what is left for the next shift.

If the alert was noise, the loop ends with tuning: adjust the rule so the same false positive does not waste a shift tomorrow. NIST SP 800-137 (Information Security Continuous Monitoring, or ISCM) is the discipline name. The rule that worked last month can flood the queue tomorrow because the business added a new app, the network team changed a default, or a vendor patch renamed a process.

Detection methods (NIST SP 800-94)

The IDPS guide catalogs the three detection approaches that show up under every SIEM and EDR rule.

Modern SIEMs combine signature plus correlation. EDR adds behavior (anomaly). Mature SOCs add stateful protocol analysis on network sensors.

Alert classification (the four buckets)

The exam tests these directly. Memorize the table.

A SOC that does not tune drowns in false positives. A SOC that over-tunes generates false negatives. Both fail differently and both fail badly.

Quarantine and alert tuning

• Quarantine isolates a host, account, file, or process so an active threat cannot spread while it is investigated. EDR can isolate a host with one click while the analyst keeps remote access for triage. Identity providers can suspend an account. Email gateways can quarantine a message before delivery. DLP can quarantine a file in cloud storage.
• Alert tuning adjusts rules so real attacks fire and noise does not. Forms include narrowing the scope (only fire on certain host groups), adding allow-list conditions for known-safe activity (a service account that legitimately runs the suspicious behavior), adjusting thresholds (require 50 failed logins instead of 5), and adding correlation (only fire when two conditions occur together). NIST SP 800-137 ISCM frames this as a continuous activity, not a one-time setup.

Mapping alerts to MITRE ATT&CK

MITRE ATT&CK is the public knowledge base of adversary tactics and techniques used to label what an alert represents. Every modern SIEM and EDR product tags detections with ATT&CK technique IDs. Common Sec+-relevant techniques:

• T1078 valid accounts (an attacker logging in with stolen credentials)
• T1110 brute force (password spraying, credential stuffing)
• T1486 data encrypted for impact (ransomware)
• T1567 exfiltration over web service (uploading stolen data to a personal cloud account)
• T1071.001 application layer protocol: web (C2 callbacks over HTTPS)
• T1059 command and scripting interpreter (PowerShell, Bash, Python abuse)

Speaking ATT&CK fluently is how a SOC analyst stops sounding like a beginner and starts sounding like a colleague.

Common gotchas

The exam likes to test the boundary cases.

• SIEM is a platform, not a product. The detection content is the work. A new SIEM with no rules is the same as no SIEM at all.
• Agent-based and agentless are not mutually exclusive. Most enterprise SOCs run both side by side.
• SCAP is a protocol. The scanner uses SCAP-formatted content. Saying "we ran SCAP" is incomplete; the answer is the scanner plus the benchmark.
• DLP false positives erode trust fast. Users find ways around an over-blocking DLP. Buy-in matters as much as configuration.
• Archiving is for investigation and compliance. Backup is for operations recovery. Different goals, different storage tiers, different test cadences.
• False negative is the dangerous classification. False positive wastes time; false negative misses the breach.
• EDR is not antivirus. EDR watches behavior and gives live response. Antivirus blocks known signatures. Modern stacks run both.
• NetFlow is not packet capture. NetFlow is the conversation envelope (who talked to whom, how much). Packet capture is the contents. Different costs, different uses.

Real-world context

Here is what the daily reality looks like for a Tier 1 analyst.

Shift start. Open the SIEM console. Read the overnight handoff from the previous shift. Check the alert queue. Note the top categories firing.

Hour by hour. Triage. Validate. Remediate when needed. Document everything. Tune the rule when an alert is clearly noise. Escalate to Tier 2 when the investigation needs more depth than the shift allows.

Day by day. Review metrics with the SOC manager: mean time to detect (MTTD), mean time to respond (MTTR), top alert categories, false positive rate, true positive rate. Adjust priorities for the week.

Quarter by quarter. Review detection coverage against MITRE ATT&CK. Identify techniques the SOC cannot see. Plan new log sources, new rules, or new tooling to close the gap.

Year by year. Rotate detection content. Retire stale rules. Onboard new sources. Replace tooling that no longer fits the environment.

The pattern repeats. Continuous monitoring is the term NIST SP 800-137 uses. Continuous is the operative word. Three habits separate a Tier 1 analyst who ships from one who drowns. Read the alert before clicking anything: pull the rule, pull the related logs, write a one-sentence verdict before you act. Tune one rule a week so false positives do not compound. Speak ATT&CK out loud so the vocabulary travels to every other SOC you ever work in.

Sources

• CompTIA Security+ SY0-701 Exam Objectives, Section 4.4 (Explain security alerting and monitoring concepts and tools)
• NIST SP 800-92 Guide to Computer Security Log Management
• NIST SP 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
• NIST SP 800-94 Guide to Intrusion Detection and Prevention Systems (IDPS)
• NIST SP 800-126 Rev 3 The Technical Specification for the Security Content Automation Protocol (SCAP) Version 1.3
• MITRE ATT&CK Framework, attack.mitre.org
• CIS Critical Security Controls v8 and CIS Benchmarks
• DISA STIGs (public.cyber.mil/stigs)
• Sigma detection rules project (github.com/SigmaHQ/sigma) for example open-source SIEM content