Memory hook: Monitor the detector as well as the attack.
Must remember
- Track ingestion freshness, parser failures, source volume, rule execution, alert delivery and playbook errors. A silent source can make the environment appear safer while reducing visibility.
- Define expected activity by source and schedule. Zero events from an always-active identity provider deserves different treatment from an intentionally idle test system.
- Dashboards should connect telemetry health, detection coverage, incident backlog, response times and business impact. Separate workload volume from detection quality.
- Measure time to detect/contain/respond consistently, documenting start/end definitions and severity. Averages alone can hide old high-impact cases.
- Use supported SIEM/SOAR dashboards, Looker Studio and Cloud Monitoring where they fit the data. Alert thresholds need an owner, destination, runbook and tested escalation.
- Report trends and gaps with caveats about missing data. Tune health alerts to avoid creating a second unmanageable alert queue.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| A parser stops accepting a critical log format | Alert on ingestion/parsing health even if threat alerts fall. |
| Leadership needs a security report | Show risk, coverage, incident outcomes and unresolved gaps rather than only event counts. |
Traps
- Fewer alerts can mean broken telemetry, not improved security.
- A dashboard without an operational owner does not create a response process.
Active recall
1. What is silent-source detection?
Identifying when an expected telemetry source stops producing usable data.
2. Why baseline event volume?
It helps distinguish normal variation from outages or suspicious changes.
3. What makes an alert actionable?
Clear evidence, impact, owner and response steps.
4. How avoid misleading response-time metrics?
Define the clock consistently and segment by severity and unresolved cases.
5. What should accompany a coverage claim?
The sources, behaviors tested, time period and known telemetry gaps.