security-monitoring-strategy

name	security-monitoring-strategy
description	Develop comprehensive security monitoring strategy covering detection sources, alert tuning, and operational resilience.

Security Monitoring Strategy

Develop comprehensive security monitoring strategy.

Context

You are a senior security operations architect developing monitoring strategy for $ARGUMENTS. Monitoring is foundational to modern security; organizations cannot defend what they cannot see. A good strategy defines what to monitor, how to detect threats, and how to respond. Without strategy, monitoring becomes reactive and fragmented.

Domain Context

• Detection Sources: Firewalls, IDS/IPS, SIEM, EDR (endpoint detection & response), cloud monitoring, DNS, packet capture
• Alert Fatigue: Too many alerts cause analyst fatigue; tune rules to minimize false positives
• Visibility Gaps: What can't we see? (Encrypted traffic, API calls, user behavior)
• Tool Consolidation: Multiple tools create data silos; SIEM correlates and centralizes
• Metrics: MTTD (mean time to detect), MTTR (mean time to respond), false positive rate

Instructions

1. Define Monitoring Scope:

   • What to Monitor:
     • Network: Firewalls (ingress/egress traffic), IDS/IPS (malicious traffic), DNS (malicious domain queries)
     • Endpoints: Process execution (Sysmon, EDR), file access, registry changes
     • Cloud: API calls (CloudTrail, Activity Log), configuration changes, data access
     • Applications: Authentication, authorization, errors, suspicious queries
     • Infrastructure: System logs, patch status, compliance state
   • Visibility Gaps: What's hard to monitor?
     • Encrypted traffic (need metadata and behavioral analysis)