Security monitoring data collection methods
As we discussed earlier, security monitoring is about detecting security incidents by looking at security-related data that is coming out of our ICS environment. But how do we get to that data and where does it come from? There are two main ways security monitoring applications can collect relevant data—namely, by recording packets on the network (packet capturing) and collecting event logs generated by the operating system, network, and automation devices, or the software and applications we are trying to protect (such as a web server log or switch log), or the security applications we use to protect or monitor the endpoint (such as an antivirus application generating events for discovered malware or a network intrusion detection system (IDS) sending System Logging Protocol (syslog) messages for anomalies). Security monitoring solutions often use a combination of these two collection methods to aggregate the necessary data, to help...
