Network monitoring and incident response: from logs to a SOC

Assume breach is a principle of modern security: we must be ready for the day part of the system is successfully attacked. On that day, time to detect and time to respond decide whether the incident stays small or becomes a crisis.

Three layers of visibility

1. Health and availability monitoring

CPU, memory, disk, service status and response time. Many “incidents” are really capacity problems — a blockchain node filling its disk, for instance — which disk monitoring and timely alerts would prevent. Tools such as Prometheus and Grafana cover this layer.

2. Security logs

Logins, permission changes, authentication failures, firewall, DNS and web-server logs. These should be collected in one central, tamper-resistant place.

3. Network traffic

Network flows (NetFlow) and intrusion detection systems (IDS) reveal behaviour such as internal scanning or connections to command-and-control servers.

What does a SIEM do?

A security information and event management (SIEM) system collects, normalises and correlates logs from many sources. One failed login is normal; 500 failed logins from one IP followed by a successful one is a serious alert.

• Correlation rules for known attack patterns
• Status and trend dashboards
• Log retention for investigations and legal requirements

Security Operations Center (SOC)

A SOC combines people, process and tools to triage alerts and respond to incidents. For smaller organisations, a managed SOC or a mix of automated alerting and an on-call technical team is a cost-effective alternative.

The incident-response cycle

1. Preparation: asset inventory, emergency contacts, access and playbooks ready in advance.
2. Identification: detect, confirm and grade the incident.
3. Containment: isolate infected systems and block accounts or IPs without destroying evidence.
4. Eradication: remove the intruder and close the entry point.
5. Recovery: restore service from a clean backup and monitor more closely.
6. Lessons learned: post-incident analysis and updated controls and playbooks.

A low-cost start

• Send logs from every server and router to a central server.
• Define alerts for disk space, service outages and admin logins.
• Keep an offline copy of backups and rehearse restores every quarter.
• Write a simple playbook for common scenarios (ransomware, leaked password, server outage).

What you cannot see, you cannot defend.