Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What are the most relevant security events/incidents any company should monitor using event management tools? Related to servers, antivirus, networks, etc.

share|improve this question

1 Answer 1

You should log everything and analyze anything. People trying to brute your sites and servers. All of these are relevant incidents as they pose a threat.

It's not relevant to say to what is an incident, as every attempt might be a relevant event some time. What is important is to catalog them with different levels. Some threats pose greater danger than others. Some of them might contain a lot of "normal behavior". The thing is that some things only become relevant after analyzing over a longer period of time. You might notice one attacker is doing his best extra hard to get in. You might get a hacked server and then you'd have to be able to go back and look for related security events to learn from the incident.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.