Definition
Security monitoring is the continuous observation and analysis of system and network activities to detect and respond to security threats and policy violations. It involves collecting, correlating, and analyzing security-related data from various sources like logs, network traffic, and endpoint devices. This proactive approach is crucial for identifying potential breaches, understanding attack patterns, and ensuring the overall security posture of an organization. For instance, monitoring firewall logs can reveal attempts to access unauthorized ports, indicating a potential intrusion. Unlike passive vulnerability scanning, security monitoring actively looks for ongoing malicious activity. This concept is fundamental to domains covered on certifications such as CompTIA Security+, CySA+, and CISSP.