Lesson 8 of 12 — Security Operations & Monitoring
If you can't see it, you can't secure it. This lesson builds the SecOps mindset: baselining normal behavior, cataloging every asset, turning log noise into actionable alerts, and safely detonating suspicious files — before an unknown device becomes a breach.
Every advanced attacker has one thing in common: they rely on their victims not being able to see them. They operate in environments where no one knows every device on the network, where logs are collected but never reviewed, and where a configuration change that opened a Telnet port goes unnoticed for months. Security Operations is the discipline that eliminates those blind spots.
The four pillars of this lesson — baseline management, asset inventory, log analysis, and safe malware investigation — form the visibility layer that makes every other security control effective. Without this layer, your firewall may be blocking known threats while an attacker you don't know about moves freely inside your network at 2:47 AM, exfiltrating 847MB of data before going offline undetected.
At 2:47 AM on a Tuesday, a DHCP lease is assigned to a device no one in IT recognizes. The MAC address doesn't match any entry in the asset inventory. Within 12 minutes, the device queries the Active Directory LDAP server, attempts three failed SMB connections to the file server, and downloads 847MB of data before going offline. By 9 AM, no one in IT knows this happened — because no alert was configured.
Discussion questions: What monitoring controls would have detected this? What should have triggered an alert? What does an attacker gain by operating at 2:47 AM specifically? Which of the four topic areas in this lesson addresses each failure?
What constitutes a secure baseline — and how unauthorized deviations become attacker footholds.
A baseline documents every measurable security attribute: open ports, services, accounts, file hashes. CIS Benchmarks and STIGs define the standard. FIM detects unauthorized changes the moment they occur. Unauthorized drift on a production server = potential compromise.
Active vs. passive discovery, CMDB architecture, and NAC enforcement for rogue device prevention.
You cannot protect what you don't know exists. Active discovery (Nmap, Nessus) probes devices directly. Passive discovery (DHCP logs, ARP analysis) observes without probing. The CMDB is your authoritative asset register. 802.1X enforces authentication before any device accesses the network.
Log taxonomy, Windows Event IDs, alert threshold design, and brute-force detection rules.
SIEM aggregates → normalizes → correlates → alerts. Key Event IDs: 4624 (logon), 4625 (failed), 4648 (explicit creds), 4720 (account created). Threshold design: too high misses attacks; too low creates alert fatigue. SOAR automates response when the alert fires.
Static vs. dynamic analysis, safe file detonation workflows, and anti-sandbox evasion awareness.
Static analysis: examine without executing (strings, hash, PE header). Dynamic: execute in isolation and observe network calls, registry writes, process spawning. VM-based (Cuckoo), cloud (VirusTotal). Anti-sandbox evasion: malware detects VM artifacts and stays dormant to avoid analysis.
Establishing the secure state and detecting when it changes — authorized or otherwise
A security baseline is a documented snapshot of every measurable attribute of a system in its known-good, secure state: open ports, running services, installed software versions, local user accounts, registry keys, and file hashes. The baseline is your reference point. Any deviation is drift — and drift must be explained.
Community-consensus hardening guidelines published by the Center for Internet Security. Cover every major OS, cloud platform, and application. Prescribe specific settings — not general principles.
Security Technical Implementation Guides — DoD-mandated hardening specifications. More prescriptive than CIS Benchmarks. Required for federal systems and many defense contractors.
Monitors cryptographic hashes of critical system files and configurations. Fires an alert the moment any monitored file is added, modified, or deleted — catching malware implants and unauthorized config changes.
You cannot protect what you don't know exists — cataloging every device on the network
Every connected device is an attack surface. An asset inventory combines automated discovery with a maintained Configuration Management Database (CMDB) to ensure that every device — workstation, server, printer, IoT sensor, contractor laptop — is catalogued, owned, and monitored. Uncatalogued assets are invisible liabilities.
Directly probes the network to enumerate devices. Generates network traffic — visible to defenders and potentially to attackers monitoring for scans.
Observes existing network traffic without generating new probe packets. Stealthier and less disruptive than active scanning — misses devices that are offline during the observation window.
IEEE standard requiring devices to authenticate before being granted network access at the switch port level. Unauthenticated devices are placed in a quarantine VLAN with no access to production resources — the primary technical control against rogue device connectivity.
Policy enforcement system that evaluates device health and identity before granting access. Combines 802.1X authentication with posture assessment (is the device patched? does it have AV? is it domain-joined?).
Turning log noise into actionable security alerts — and catching attacks before the damage is done
Logs are the security camera footage of your infrastructure. Every authentication, connection, configuration change, and error is recorded somewhere. The challenge isn't collection — it's making sense of millions of log lines across hundreds of systems and firing the right alert at the right moment.
| Event ID | Meaning | Attack Relevance |
|---|---|---|
| 4624 | Successful logon | After multiple 4625s, a 4624 = successful brute-force |
| 4625 | Failed logon attempt | Multiple in short window = brute force / credential stuffing |
| 4648 | Logon with explicit credentials | Pass-the-hash, lateral movement, credential reuse |
| 4720 | User account was created | Persistence — attacker creating backdoor account |
The most critical SIEM configuration decision is threshold calibration:
Isolating and detonating suspicious files to extract behavioral intelligence without risk to production
Traditional AV scanning uses signatures — known patterns of malicious code. It misses novel malware, obfuscated scripts, and fileless attacks entirely. Sandboxing complements signature detection by executing a suspicious file in complete isolation and observing every action it takes: network connections, registry modifications, file writes, process spawning.
Examine the file without executing it:
Execute in isolation and observe runtime behavior:
Cuckoo Sandbox, Any.run — full OS isolation with snapshot/restore. Captures all system calls. Requires infrastructure investment.
VirusTotal, Hybrid Analysis, Joe Sandbox — community intelligence, fast results, shared IoC database. Caution: samples uploaded are visible to other users.
Sophisticated malware detects VM artifacts (registry keys, hypervisor processes, screen resolution, MAC prefix) and remains dormant to avoid analysis. Counter: physical sandbox hardware, delayed detonation, environment obfuscation.
Identify configuration violations on a drifted production server
Identify known assets and flag rogue devices on your network
Configure SIEM thresholds and catch the brute-force attack before the data is gone
Route each suspicious file to the correct analysis action
Lesson 8: Security Operations & Monitoring · SY0-701 Objectives 4.3 – 4.6
