CompTIA · Security+ SY0-801
Alerting and monitoring
Security+ SY0-801 · Lesson 21 of 32 · 3:08:22
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the Security+ SY0-801 exam (CompTIA Security+ V8). In this lesson: what to monitor, monitoring tools (SIEM, agents and agentless monitoring, benchmarks, and vulnerability scanners), monitoring protocols (NetFlow, SNMP, syslog, and SCAP), and network views like port mirroring and dashboards, from an alert at three in the morning. Includes three original practice questions.
Preview the topics
- Ashgrove wants the logs of its servers, firewalls, and cloud services collected in one place, correlated, and turned into alerts and dashboards. What should it deploy?
- The team wants to see which hosts talk to which, with the ports and the volume of each conversation, but without capturing any content. Which data source fits?
- The security team receives four thousand alerts a day, nearly all of them false alarms, and analysts have started to ignore them. What should the team do?