4.4: Explain security alerting and monitoring concepts and tools

These flashcards cover key concepts related to security alerting and monitoring from the lecture notes.

The core function of a SIEM tool is to __________ data from network sensors and appliance logs.

Collect and correlate

Agent-based collection means installing an agent service on each __________.

Host

True negatives are a measure of events that the system has __________ allowed.

Properly

A process that runs on the management server to parse and normalize logs is known as __________-based collection.

Listener/collector

__________ refers to normalizing data from different sources so that it is consistent and searchable.

Log aggregation

A SIEM correlation rule uses __________ expressions to match certain conditions.

Logical

When an alert is generated but there is no actual threat activity, it is referred to as a __________ positive.

False

A SIEM can assist with __________ activity by exporting summary statistics and graphs.

Reporting

SIEM performance will degrade if an excessive amount of __________ is kept available for live analysis.

Data

One of the functions of a vulnerability scan is to assess the configuration of security __________ and application settings.

Controls