From the course: SecOps on Google Distributed Cloud (GDC) for Tier 1 and Tier 2 Analysts by Google

Monitoring security events - Google Cloud Platform Tutorial

From the course: SecOps on Google Distributed Cloud (GDC) for Tier 1 and Tier 2 Analysts by Google

Start my 1-month free trial Buy for my team

Monitoring security events

“

- [Instructor] Monitoring and intake represent the initial stages where potential security events are identified, detected, triaged, and classified for further investigation and remediation. Efficient incident response involves continuous monitoring of security systems and logs combined with effective intake procedures for handling potential incidents reported by various sources. Let's start by exploring the purpose of continuous monitoring. During the monitoring phase, Tier 1 analysts monitor security systems and logs for suspicious activity. The goal of this phase is twofold: early detection of security events, the accurate identification of genuine incidents. To achieve these goals, Tier 1 analysts use various tools and techniques, endpoint detection and response, EDR solutions, and security information and event management, SIEM, systems. By combining EDR and SIEM, the analysts can detect anomalies about user behavior and take action accordingly. For example, if you notice a sign-on to the company outside of business hours, a policy can be created that blocks the copying of data outside of business hours. Tier 1 analysts also work to accurately identify genuine incidents. This involves learning to differentiate between real security events and false alarms, false positives. This ability requires robust detection mechanisms and skilled analysts to analyze alerts and identify true threats. By learning to accurately identify genuine incidents, you help to avoid unnecessary resource allocation and wasted time. A detection modality is a general term that refers to the various detection methods employed by Tier 1 analysts during the monitoring phase. These modalities aim to detect potential security events and can be automated, internal, or external. Each method offers distinct advantages and limitations. In the following videos, you'll explore each one.

Contents