# Security Operations Basics

> Chapter 13 of the Courseiva ISC2-CC curriculum — https://courseiva.com/learn/isc2-cc/security-operations-basics

**Official objective:** 4.1 — Describe the role of security operations, including monitoring, logging, and incident detection.

## Introduction

Exam objective 4.1 asks you to describe the role of security operations — specifically monitoring, logging, and incident detection. Security operations is the part of an organisation that watches for attacks, records what happens, and sounds the alarm when something goes wrong. Without this function, a company could be under cyber attack for months and never realise it.

## The Office Building Security Desk Analogy

A security operations centre (SOC) is a central room where security analysts watch the organisation's digital network for trouble, just like a building's security desk monitors the lobby and hallways.

Think of a large office building with dozens of floors, hundreds of offices, and thousands of employees. The building manager installs security cameras at every entrance, corridor, and stairwell. These cameras record everything that happens — that is the logging function. A security guard sits at the main desk watching the live feeds. If a camera catches someone trying to force open a locked door after hours, the guard notices the unusual motion and investigates — that is monitoring. If the intruder actually breaks in, the guard radios the police and locks down the floor — that is incident detection and response.

Now map that to IT: the building is your corporate network, the cameras are log-generating devices (servers, firewalls, endpoints), the recorded footage is the log files, and the security guard is the SOC analyst using a Security Information and Event Management (SIEM) tool. The SIEM collects all the camera feeds (logs) into one screen, highlights odd behaviour (alerts), and helps the analyst decide whether it is a false alarm or a real break-in. Without this setup, the organisation would never know a theft occurred until the next morning — which in IT terms is a data breach discovered weeks later.

## Core explanation

Security operations is the practice of continuously watching an organisation's systems for suspicious activity, recording those activities for later review, and taking action when a potential security incident is identified. It is the digital equivalent of having a security guard patrol a building 24/7 — except the guard is monitoring computer networks, servers, databases, and cloud services.

Three core pillars support security operations: monitoring, logging, and incident detection. Each serves a distinct purpose, and all three must work together for the system to be effective.

**Monitoring** means actively checking systems and network traffic for anything unusual. This happens in real time or near-real time. A Security Information and Event Management (SIEM) tool is the central platform that collects data from many sources — firewalls, servers, antivirus software, user logins — and displays it on a single dashboard. The SIEM can also generate alerts when it spots patterns that match known attack signatures or behaviours that deviate from normal baselines. For example, if a user logs in from New York at 9 AM and then logs in from China at 9:05 AM, the SIEM flags that as impossible travel and raises an alert.

**Logging** is the process of recording events that happen on IT systems. A log is a time-stamped record of an event — a user logging in, a file being deleted, a connection attempt to a blocked website. Every device on a network generates logs. Centralised logging means sending all those logs to a single location, often called a syslog server or a log management system. This makes it possible to search across millions of events to find evidence of an attack. Logs also provide an audit trail, which is essential for understanding what happened after a breach and for meeting compliance requirements like those in the Payment Card Industry Data Security Standard (PCI DSS) or the Health Insurance Portability and Accountability Act (HIPAA).

**Incident detection** is the process of analysing monitoring alerts and log data to decide whether a real security incident has occurred. An incident is defined as a violation of an organisation's security policies — for example, an unauthorised user gaining access to a system, malware being installed, or sensitive data being exfiltrated. Analysts in a Security Operations Centre (SOC) triage alerts, meaning they prioritise them by severity. A low-severity alert might be someone mistyping their password five times. A high-severity alert could be a known ransomware strain attempting to encrypt files. The analyst then either closes the alert as a false positive or escalates it to an incident response team for containment.

Why do organisations need dedicated security operations? Historically, companies relied on firewall logs and antivirus software that only checked files against known virus definitions. Attackers evolved. They now use advanced persistent threats (APTs), which stay hidden in networks for months, slowly stealing data. Security operations, especially with a SIEM and a human analyst, can spot subtle signs that automated tools miss. For instance, a single failed login is normal, but 50 failed logins across 10 different accounts in two minutes indicates a password-spraying attack.

The concept of **defence in depth** is tightly linked to security operations. Defence in depth means layering multiple security controls so that if one fails, another catches the threat. Security operations is the layer that watches all the other layers. It monitors the firewall, the endpoint detection software, the access controls, and the user behaviour. It provides the oversight that no single tool can give.

Technologies involved include:
- SIEM (Security Information and Event Management): aggregates and analyses logs in real time.
- IDS/IPS (Intrusion Detection System / Intrusion Prevention System): detects and blocks known attack patterns.
- EDR (Endpoint Detection and Response): monitors individual computers for suspicious processes.
- SOAR (Security Orchestration, Automation and Response): automates repetitive tasks like blocking an IP address across all firewalls.

Security operations replaces the old reactive approach — waiting for a user to report a problem — with a proactive, continuous state of vigilance. The goal is to reduce the time between when an attack happens and when it is discovered, called the dwell time. Lower dwell time means less damage.

## Real-world context

An IT professional working in a SOC has a typical day structured around three activities: monitoring dashboards, investigating alerts, and maintaining the logging infrastructure.

Here is a concrete scenario. Jane is a security analyst at a medium-sized e-commerce company that accepts credit card payments. She arrives at 8 AM and opens the SIEM dashboard. The dashboard shows a summary of events from the past 12 hours. She sees a spike in failed logins from a single IP address starting at 3 AM. The IP originates from a country where the company does no business. Jane immediately flags this as a brute-force attack attempt.

- Jane drills into the raw logs using the SIEM's query interface. She filters by the suspicious IP and sees 1,200 failed login attempts against the admin portal. The last attempt succeeded — the attacker guessed the password.
- She checks the admin account's activity after the successful login. The logs show the attacker created a new, hidden user account named 'support_backup'. This is a persistence mechanism — the attacker wants to keep access even if the original password is changed.
- Jane follows the process for incident escalation. She creates a ticket in the incident management system, tags it as 'Critical — Credential Compromise', and pages the incident response team via an automated alert.
- While waiting for the response team, Jane manually blocks the IP address on the company's firewall, using the SIEM's built-in orchestration feature. She also forces a password reset on the compromised admin account.
- The incident response team arrives and begins forensic analysis. They isolate the affected server, examine the new user account, and check for any data exfiltration. Meanwhile, Jane reviews the log retention policy to ensure the relevant logs are not overwritten during the investigation.

Later in the day, Jane's tasks shift to proactive maintenance:
- She reviews log sources to ensure all critical servers are sending logs to the SIEM. A misconfigured web server was not forwarding logs, creating a blind spot. She submits a configuration change request to the server team.
- She updates the SIEM correlation rules to reduce false positives. The SIEM has been alerting on legitimate activity by the HR team running payroll — she adds an exception for those user accounts.
- She generates a weekly report for management summarising the number of alerts, incidents, and blocked attacks. This report helps justify the SOC budget.

Real-world security operations also involve collaboration. Jane shares threat intelligence indicators with other analysts. If she detects a previously unknown malware strain, she extracts its file hash and uploads it to a shared threat intelligence platform. This helps other organisations block the same attacker before they strike.

The most valuable skill for a SOC analyst is not deep programming knowledge — it is the ability to ask the right questions of log data. 'Is this normal for a Tuesday?' 'Does this user usually access HR files?' 'Why is data being sent to an IP we have never contacted before?' Curiosity and methodical thinking matter more than memorising command lines.

## Exam focus

The CC exam tests security operations basics in Objective 4.1 — but it does so at a conceptual level. You will not be asked to configure a SIEM or interpret raw logs. Instead, expect multiple-choice questions that test your understanding of what each component does and how they relate.

Key areas the exam focuses on:
- **Purpose of logging**: Questions will ask why an organisation implements logging. The correct answer relates to creating an audit trail for incident investigation and compliance. Watch for trap answers that claim logging prevents attacks — it does not. Logging only records events; it does not block them.
- **Role of monitoring**: Expect questions that frame monitoring as a continuous, real-time activity. A trap might describe monitoring as a weekly review of logs — that is inaccurate. Monitoring must be ongoing to be effective.
- **Incident detection vs. monitoring**: These are often confused. Monitoring is the process of watching. Incident detection is the act of identifying that a specific event violates policy and warrants action. The exam may present a scenario where logs show unusual activity, and ask whether that is monitoring, logging, or incident detection. If the scenario describes someone noticing the pattern, it is detection. If it describes collecting the data, it is logging.
- **SIEM basics**: The exam expects you to know that a SIEM aggregates logs from multiple sources and correlates them to generate alerts. A common trap is suggesting that a SIEM can automatically stop an attack. Most SIEMs do not prevent attacks directly — they alert analysts, who then take action. (SOAR tools can automate some responses, but the exam treats SIEM and SOAR separately.)
- **Defence in depth**: You must understand that security operations is one layer in a multi-layered defence. A question might ask: 'Which of the following best describes the value of security operations?' The correct answer emphasises that it provides the monitoring and detection layer that complements preventive controls like firewalls.
- **Incident response phases**: While not fully detailed in this objective, the CC exam occasionally ties security operations to the incident response process (preparation, detection, containment, eradication, recovery). Know that detection is the phase where security operations plays its primary role.
- **Log management best practices**: Questions may cover the need to protect log integrity. If logs can be altered by an attacker, they lose evidentiary value. The correct answer often mentions read-only storage or centralised logging to a secure server.

Traps the exam sets:
- Confusing 'logging' with 'monitoring' in answer choices.
- Offering 'eliminates all security risks' as an answer — nothing eliminates all risks.
- Suggesting that small organisations do not need security operations — the correct position is that every organisation needs some form, even if scaled down.
- Claiming that SIEM replaces human analysts — it augments them but does not replace their judgement.

Memorise these definitions exactly:
- **Log**: A record of an event that occurred on a system.
- **Monitoring**: Actively observing systems and networks for signs of trouble.
- **Incident**: A violation of security policy that may lead to data loss or system damage.
- **SIEM**: A tool that centralises log collection and analysis.
- **Alert**: A notification generated when a SIEM finds a pattern matching a known threat or anomaly.

## Step by step

1. **Log Generation** — Every device on the network — servers, firewalls, workstations, cloud services — generates log entries whenever an event occurs. A log entry typically includes a timestamp, the source IP, the user account, and the action performed. For example, when a user accesses a file server, the server logs the user's name, the file name, and the time of access.
2. **Log Forwarding and Centralisation** — Logs are forwarded from individual devices to a central location, usually the SIEM or a dedicated log management server. This step is critical because if logs remain on individual devices, an attacker who compromises a machine can delete them to cover their tracks. Centralisation preserves logs even after a device is wiped.
3. **Log Normalisation and Correlation** — The SIEM takes logs from different sources and normalises them into a standard format. Different vendors format logs differently — a firewall might log a connection as 'src=10.0.0.1 dst=8.8.8.8 port=443' while a server uses a different syntax. Normalisation makes them comparable. Then the SIEM applies correlation rules to link seemingly unrelated events into a coherent pattern, such as 'multiple failed logins followed by a successful login from the same IP'.
4. **Alert Generation and Triage** — When a correlation rule matches, the SIEM generates an alert. Alerts are categorised by severity — low, medium, high, critical. A SOC analyst triages these alerts, meaning they review the alert details and decide if it is a true positive (a real attack) or a false positive (benign activity that triggered the rule accidentally). Low-severity alerts may be handled in batches; critical alerts demand immediate attention.
5. **Incident Declaration and Escalation** — If the analyst confirms that an alert represents a genuine security policy violation, they declare an incident. This triggers a formal escalation process: the analyst documents the evidence, creates a ticket in the incident management system, and notifies the incident response team. The response team then takes over to contain, eradicate, and recover from the incident.

## Comparisons

### Logging vs Monitoring

**Logging:**
- Passive recording of events with timestamps and details.
- Does not require a human to watch the data in real time.
- Purpose is to create an audit trail for later inspection or compliance.

**Monitoring:**
- Active, continuous observation of systems and logs as events occur.
- Relies on human or automated review of logs as they arrive.
- Purpose is to detect and respond to threats as soon as they happen.

### SIEM (Security Information and Event Management) vs SOAR (Security Orchestration, Automation and Response)

**SIEM (Security Information and Event Management):**
- Focuses on collecting, normalising, and correlating logs to generate alerts.
- Primarily a detection tool that alerts human analysts.
- Does not typically take automated action against threats.

**SOAR (Security Orchestration, Automation and Response):**
- Focuses on automating the response to alerts, reducing manual work.
- Integrates with existing tools to block IPs, isolate endpoints, etc.
- Takes predefined actions automatically based on playbook rules.

### Incident Detection vs Incident Response

**Incident Detection:**
- The process of recognising that a security policy has been violated.
- Happens continuously as part of security operations.
- Ends when the incident is declared and passed to the response team.

**Incident Response:**
- The process of containing, eradicating, and recovering from an incident.
- Begins after an incident is declared and is a separate, time-boxed activity.
- Involves forensic analysis, system restoration, and post-incident review.

## Diagram

_This diagram shows the flow from log generation by network devices through centralisation in a SIEM, correlation and alerting, then triage by an analyst leading either to incident declaration or alert closure._

```mermaid
flowchart TD
    A[Network Devices] --> B[Log Generation]
    B --> C[Log Forwarding]
    C --> D[SIEM Centralisation]
    D --> E[Log Normalisation]
    E --> F[Correlation Rules]
    F --> G[Alert Generation]
    G --> H{Analyst Triage}
    H -- True Positive --> I[Incident Declared]
    I --> J[Incident Response Team]
    H -- False Positive --> K[Alert Closed]
    J --> L[Containment & Recovery]
```

## Common misconceptions

- **Misconception:** Logging and monitoring are the same thing because both involve looking at system data. **Reality:** Logging is the passive recording of events; monitoring is the active, real-time inspection of those events. You can have logs without monitoring, but monitoring depends on logs. (The words are used loosely in casual conversation, so beginners naturally merge them into one concept. The exam deliberately separates them.)
- **Misconception:** A SIEM automatically stops cyber attacks once it detects them. **Reality:** A SIEM generates alerts for analysts to review. It does not directly block traffic or disable user accounts unless integrated with separate orchestration tools (SOAR). The decision to stop an attack is made by a human. (Beginners hear 'security tool' and assume it takes full automatic action, like antivirus deleting a file. The CC exam tests the distinction between detection and response.)
- **Misconception:** Security operations is only needed by large corporations with huge budgets. **Reality:** Every organisation that uses IT systems needs at least basic logging and monitoring, even if handled by a managed service provider (MSP) or a part-time employee. Small businesses are frequent targets precisely because they lack security ops. (Many beginners come from small workplaces that outsource IT. They think security operations is an expensive luxury, not a fundamental practice.)
- **Misconception:** If you have a firewall and antivirus, you do not need security operations. **Reality:** Preventive tools like firewalls and antivirus reduce risk but cannot stop all attacks. Security operations fills the gap by detecting what these tools miss — such as legitimate accounts used by attackers or malware that evades signature detection. (It feels logical to beginners that buying more security products equals being secure. The concept of detection as a separate function is unintuitive until you experience a breach.)
- **Misconception:** An incident is any event recorded in a log. **Reality:** An incident is specifically an event that violates security policy — not every log entry. A successful user login is an event but not an incident. An incident is something like unauthorised access, malware execution, or data exfiltration. (The term 'incident' sounds broad, so beginners assume it covers all logged events. The exam uses the precise definition from NIST: a violation or imminent threat of violation of security policies.)

## Key takeaways

- Security operations consists of three linked activities: logging records events, monitoring watches for trouble in real time, and incident detection identifies when a security policy has been violated.
- A SIEM is a central platform that collects logs from across the network and correlates them to produce alerts for analysts to investigate.
- Logging does not prevent attacks; it creates an audit trail that is essential for investigating incidents after they occur and for meeting compliance requirements.
- Monitoring must be continuous and real-time to be effective — periodic reviews of logs are not considered proper monitoring in a professional context.
- Defence in depth means security operations is one layer that detects failures in other layers, such as firewalls or access controls.
- An incident is formally defined as a violation of an organisation's security policies, not merely any unusual system event.
- Dwell time is the period between when an attack starts and when it is discovered; effective security operations aims to reduce dwell time to minimise damage.

## FAQ

**What is the difference between a log and a SIEM?**

A log is a single record of an event from one device. A SIEM is a system that collects millions of logs from many devices and analyses them to find patterns. Think of logs as individual puzzle pieces and the SIEM as the table where an analyst assembles the puzzle.

**Do I need to know how to use a specific SIEM tool to pass the CC exam?**

No. The CC exam is vendor-neutral. You do not need to know how to use Splunk, Sentinel, or any other specific product. You only need to understand what a SIEM is and what it does at a conceptual level.

**Can logging slow down my computer?**

Logging itself uses minimal resources — it writes small text entries to a file. However, sending logs over the network to a central server uses bandwidth. Organisations manage this by setting appropriate log levels (e.g., logging only warnings and above for high-traffic devices) and using efficient forwarding protocols.

**What happens if an attacker deletes the logs?**

If logs are stored only on the compromised device, the attacker can delete them to hide their activity. That is why centralised logging is essential — logs are sent to a separate, secure server that the attacker cannot easily access. Some systems use write-once storage that prevents any alteration.

**How is monitoring different from surveillance?**

In IT, 'monitoring' usually refers to automated systems collecting and analysing data, while 'surveillance' suggests human watching. In practice, monitoring includes both automated observation by tools and human review of dashboards. The CC exam treats them as rough synonyms in this context.

**Is security operations the same as incident response?**

No. Security operations is the ongoing, day-to-day activity of watching and detecting. Incident response is a separate, time-limited process that kicks off after an incident is declared. Security operations feeds into incident response by providing the initial detection data.

## Check your understanding

1. **What is the primary purpose of logging in security operations?**

   Answer: To create an audit trail of events that can be used for investigating incidents and meeting compliance requirements.

2. **How does a SIEM differ from a simple log file?**

   Answer: A SIEM centralises logs from many sources, normalises them into a common format, and applies correlation rules to detect patterns that individual logs would not reveal.

3. **What is the first step an analyst takes after a SIEM generates an alert?**

   Answer: Triage — the analyst reviews the alert details to determine whether it is a true positive (a real threat) or a false positive (benign activity).

4. **Why is continuous, real-time monitoring important rather than reviewing logs weekly?**

   Answer: Attackers can cause significant damage in hours or minutes; real-time monitoring allows the organisation to detect and respond quickly, reducing dwell time.

5. **What defines a security incident as opposed to a normal system event?**

   Answer: A security incident is an event that violates the organisation's security policies, such as unauthorised access, malware execution, or data exfiltration.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/isc2-cc/security-operations-basics