What's changed: Created Professional Security Operations Engineer Chapter 6 (Domain 6 "Observability": key security analytics (metrics/KPIs=MTTD-MTTR/trends), dashboards (Google SecOps SOAR/SIEM/Data Studio), report generation/customization; health-monitoring metrics, centralized dashboards, threshold alerts, Cloud Monitoring notifications, identifying health issues with Cloud Logging, silent source detection).
6.2Health monitoring and alerting
Understand identifying important metrics for health monitoring/alerts, creating dashboards that centralize metrics, creating threshold alerts for specific metrics, configuring notifications with Google Cloud tools (Cloud Monitoring), identifying health issues with Google Cloud tools (Cloud Logging), and configuring silent source detection.
If the security platform itself is unhealthy, detection fails. Monitor whether logs have stopped or ingestion is stalling.
6.2.1Health monitoring and threshold alerts
For health monitoring of the security platform, identify important metrics (ingestion rate, pipeline latency, error rate, storage usage) and centralize them in a dashboard. To catch issues early, create threshold alerts on specific metrics and notify via Cloud Monitoring on breach (email/PagerDuty/Pub/Sub). Identify platform-side health issues from Cloud Logging. Map "measure platform health = health-monitoring metrics + threshold alerts" and "notification = Cloud Monitoring."
6.2.2Silent source detection
The most dangerous case is "logs stopping unnoticed." Configure silent source detection to detect when a log source is not sending data as expected (i.e., silent). For example, if a firewall that should send logs every minute is silent for an hour, detection may not be working (or an attacker stopped logs), so alert. This prevents "detection blind spots (nothing detected because no logs arrive)." Map "detect a source that stopped sending logs = silent source detection."
Common: requirement → means. E.g., "notify when ingestion latency/error rate exceeds a threshold" = threshold alerts + Cloud Monitoring; "identify platform health issues from logs" = Cloud Logging; "detect a source that stopped sending logs as expected" = silent source detection; "centralize operational metrics on one screen" = a centralized dashboard.
Watch the mix-ups: (1) Security detection (threats) vs health monitoring (platform health) differ—if the platform stalls, threat detection fails too. (2) No logs arriving is not normal—close the blind spot with silent source detection. (3) Threshold alerts that fire too much or too little are both problems—tune thresholds appropriately.
6.2.3Section summary
- Platform health = centralize key metrics (ingestion rate/latency/error rate) with threshold alerts
- Notification = Cloud Monitoring; identify health issues = Cloud Logging
- Detect a source that stopped sending logs = silent source detection to prevent blind spots
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. A firewall that should send logs every minute went silent for an hour. To detect this and prevent a blind spot, which is best?
Q2. To notify via email/PagerDuty when ingestion latency or error rate exceeds a threshold, which is best?
Q3. To identify platform-side health issues (e.g., pipeline errors) from logs, which is best?
Q4. Which correctly relates security detection (threats) and health monitoring (platform health)?
Q5. When designing a health-monitoring dashboard, what should you do first?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.