Monitoring

Monitoring focuses on collecting, reviewing, and analyzing security data from systems, applications, networks, and security tools.

Topics

• Windows Event Logging — Core Windows logs, important event IDs, and security investigation basics.
• Log Sources — Common sources of telemetry such as endpoints, firewalls, proxies, DNS, and authentication systems.
• Splunk — Searching, filtering, and investigating security events in a SIEM.
• IDS / IPS — Detecting and blocking suspicious network activity.
• YARA and Sigma — Rule-based detection for files, malware, logs, and security events.