Skip to content
BoKSA

2 — Monitoring: the data sources

2 — Monitoring: the data sources

Study time: ± 60 minutes (reading + hands-on)

What monitoring is

Monitoring is the deliberate collection of activity traces so you can see what is happening in a system. The core idea: an attack leaves traces somewhere, and you need to know which source holds them. Collecting more than you can analyse is wasteful; collecting the wrong source means you miss the attack entirely.

The four data sources

  • Network traffic — the raw data flowing over the network (who talks to whom, how much, which protocols). Full-packet capture (pcap, the format Wireshark reads) gives the most detail but costs huge storage, so sensors often inspect it on the fly. Good for spotting low-level attacks.
  • Network aggregates (e.g. Netflow) — summary counters instead of full packets. Cheap, good for large-scale events like DDoS, but often sampled — so stealthy low-volume attacks can slip through. A real blind spot to be aware of.
  • Application and web logs — what servers and applications recorded (the Common Log Format of web servers, for instance).
  • System and kernel logs — what the operating system recorded (audit trails).

Two more things worth knowing: modern traffic is encrypted with TLS, which hides payloads from sensors, so keeping visibility without breaking privacy is a real design question. And keep the event vs alert distinction sharp — an event is a raw trace (a login, a packet); an alert is what a sensor produces when it recognises a pattern worth attention.

Core resources

  • Wireshark — download it and capture your own traffic. The fastest way to understand what "network monitoring" actually means. Only capture on networks you own or have permission to analyse. (± 30 min hands-on)
  • CyBOK KA 8, section 2 (Monitor) — the authoritative treatment of data sources. (± 20 min)

Check yourself

  1. Name two of the four data sources and describe an attack you might see in each.
  2. Why can Netflow sampling be a blind spot? What kind of attack would it miss?
  3. Why does TLS encryption make a monitoring sensor's job harder?
  4. Give an example of an event and an alert that could come from that same event.