Logging is not detection
A09 was renamed from Security Logging and Monitoring Failures to Security Logging and Alerting* Failures, and that one word is this lesson's whole content. Having logs does not mean having detection.* Many organisations have enough logs to investigate an incident after learning of it, and nothing that tells them it is happening.
Three levels, and most organisations stop at the first:
| Level | What exists | Answers |
|---|---|---|
| 1. Logging | Log lines exist | "What happened?" — after you already know something did |
| 2. Queryable | Centralised, indexed, retained long enough | "Did this happen?" — when you think of the question |
| 3. Alerting | A rule running automatically | "Is something happening?" — without you asking |
The gap between levels 2 and 3 is the decisive one in a real incident, because level 2 requires a human to think of the right question — and at 3am on a Sunday nobody is thinking.
And here is the most important part: a muted alert is an alert that does not exist.
This is not soft advice but an operational law. An alert with 90% false positives gets ignored by whoever is on call by week two, muted by week four, and that mute is never lifted. So the false-positive rate is a design criterion for an alert, as important as its coverage.
Four alerts with low false-positive rates and high detection value — the four worth building first:
| Alert | Why few false positives |
|---|---|
One account receiving >50 403s in 5 minutes | Real users do not hit 403 repeatedly; the UI does not let them |
| A successful login from a new country for a privileged account | Rare, and each one is worth a look |
| An account exporting >10× its own median volume | Compared against itself, not against others |
| Any role change not made through the admin UI | It only happens when something is unusual |
Note the third: compare an account against itself, not against a system-wide average. An enterprise user exporting 50,000 rows daily is normal for them; the same number for a personal account is not. An absolute threshold produces false positives at the top end and misses at the bottom.
Comments
Commenting needs an account with at least one completed lesson. That condition is what keeps this thread worth reading: every point belongs to someone who can be asked back, and reputation accrues over time.
You can still read every comment below without an account. Signing in brings you back to this exact spot, not to the top of the page.
Loading comments…