Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Save more on your purchases now! discount-offer-chevron-icon
Savings automatically calculated. No voucher code required.
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
CompTIA Security+: SY0-601 Certification Guide

You're reading from   CompTIA Security+: SY0-601 Certification Guide Complete coverage of the new CompTIA Security+ (SY0-601) exam to help you pass on the first attempt

Arrow left icon
Product type Paperback
Published in Dec 2020
Publisher Packt
ISBN-13 9781800564244
Length 550 pages
Edition 2nd Edition
Languages
Arrow right icon
Author (1):
Arrow left icon
Ian Neil Ian Neil
Author Profile Icon Ian Neil
Ian Neil
Arrow right icon
View More author details
Toc

Table of Contents (24) Chapters Close

Preface 1. Objectives for the CompTIA Security+ 601 exam 2. Section 1: Security Aims and Objectives FREE CHAPTER
3. Chapter 1: Understanding Security Fundamentals 4. Chapter 2: Implementing Public Key Infrastructure 5. Chapter 3: Investigating Identity and Access Management 6. Chapter 4: Exploring Virtualization and Cloud Concepts 7. Section 2: Monitoring the Security Infrastructure
8. Chapter 5: Monitoring, Scanning, and Penetration Testing 9. Chapter 6: Understanding Secure and Insecure Protocols 10. Chapter 7: Delving into Network and Security Concepts 11. Chapter 8: Securing Wireless and Mobile Solutions 12. Section 3: Protecting the Security Environment
13. Chapter 9: Identifying Threats, Attacks, and Vulnerabilities 14. Chapter 10: Governance, Risk, and Compliance 15. Chapter 11: Managing Application Security 16. Chapter 12: Dealing with Incident Response Procedures 17. Section 4: Mock Tests
18. Chapter 13: Mock Exam 1
19. Mock Exam 1 Solutions
20. Chapter 14: Mock Exam 2
21. Mock Exam 2 Solutions
22. Chapter Review Solutions 23. Other Books You May Enjoy

Syslog/Security Information and Event Management

The systems on a network produce a massive amount of information in log files and most of them will be related to errors or possible attacks. They will require a real-time solution to correlate these events so that the security team can be alerted immediately. Let's look at the role that the SIEM and syslog server play.

Security Information and Event Management (SIEM) is regarded as an IT best practice, used by regulated industries to fulfill security and audit compliance regulations, for example, HIPAA, GDPR, SOX, and PCI DSS. SIEM supports IT teams by consolidating event log values through the correlation, aggregation, normalizing standard, and non-standard log formats; it can also filter out false positives.

The only time that a SIEM system will not provide the correct information is when the wrong filters are used or the wrong host is monitored. In these cases, a false positive will be produced.

A System Logging (Syslog...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime