What are the most relevant security events/incidents any company should monitor using event management tools? Related to servers, antivirus, networks, etc.
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
||||
|
|
|
You should log everything and analyze anything. People trying to brute your sites and servers. All of these are relevant incidents as they pose a threat. It's not relevant to say to what is an incident, as every attempt might be a relevant event some time. What is important is to catalog them with different levels. Some threats pose greater danger than others. Some of them might contain a lot of "normal behavior". The thing is that some things only become relevant after analyzing over a longer period of time. You might notice one attacker is doing his best extra hard to get in. You might get a hacked server and then you'd have to be able to go back and look for related security events to learn from the incident. |
|||
|
|
