What's changed: Created Professional Security Operations Engineer Chapter 6 (Domain 6 "Observability": key security analytics (metrics/KPIs=MTTD-MTTR/trends), dashboards (Google SecOps SOAR/SIEM/Looker Studio), report generation/customization; health-monitoring metrics, centralized dashboards, threshold alerts, Cloud Monitoring notifications, identifying health issues with Cloud Logging, silent source detection).
6.2Health monitoring and alerting
Understand identifying important metrics for health monitoring/alerts, creating dashboards that centralize metrics, creating threshold alerts for specific metrics, configuring notifications with Google Cloud tools (Cloud Monitoring), identifying health issues with Google Cloud tools (Cloud Logging), and configuring silent source detection.
If the security platform itself is unhealthy, detection fails. Monitor whether logs have stopped or ingestion is stalling.
6.2.1Health monitoring and threshold alerts
For health monitoring of the security platform, identify important metrics (ingestion rate, pipeline latency, error rate, storage usage) and centralize them in a dashboard. To catch issues early, create threshold alerts on specific metrics and notify via Cloud Monitoring on breach (email/PagerDuty/Pub/Sub). Identify platform-side health issues from Cloud Logging. Map "measure platform health = health-monitoring metrics + threshold alerts" and "notification = Cloud Monitoring."
6.2.2Silent source detection
The most dangerous case is "logs stopping unnoticed." Configure silent source detection to detect when a log source is not sending data as expected (i.e., silent). For example, if a firewall that should send logs every minute is silent for an hour, detection may not be working (or an attacker stopped logs), so alert. This prevents "detection blind spots (nothing detected because no logs arrive)." Map "detect a source that stopped sending logs = silent source detection."
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.