Overview
Individual checks are useful, but real defense comes from continuous monitoring — routinely observing logs, processes, and resources to catch problems and intrusions. This capstone lesson brings the module together into a monitoring mindset that leads into the SOC/Blue Team path.
Learning objectives
- Define continuous monitoring and its goals.
- Combine logs, processes, and resource data into a monitoring routine.
- Understand the value of centralized monitoring and alerting.
Core concept
Monitoring is the ongoing practice of observing a system's state — its logs, processes, and resource usage — to detect faults, performance issues, and security events. Effective monitoring rests on:
- A baseline of normal behavior, so deviations stand out.
- Watching the right signals: authentication logs, unexpected processes, resource anomalies, network sockets.
- Alerting on important conditions rather than watching manually forever.
- Ideally centralizing data from many hosts for correlation and tamper-resistance.
How it works
Continuous monitoring ties the module's skills together: logs (what happened), the journal (queryable events), process observation (what is running), and resource usage (system health) are watched over time against a baseline. On a single host you might follow journalctl -f and top; at scale, logs and metrics are forwarded to a central system that stores them safely and raises alerts on suspicious patterns (e.g. repeated failed logins, a new listening port, a CPU spike). This scales human attention and preserves evidence even if a host is compromised.
Practical example
A monitoring setup notices a burst of "Failed password" entries for many usernames from one IP (from auth logs), correlates it with a new ss listening port and a CPU spike on the same host, and raises an alert. Individually each signal is a lead; together they indicate a likely brute-force followed by a foothold. Centralized collection meant the evidence survived even as the attacker tried to clear local logs — enabling a confident response.
Cybersecurity relevance
Continuous monitoring is the essence of blue-team defense and the direct on-ramp to the SOC path. It is how intrusions are detected early, how availability and integrity are protected, and how incidents are investigated with reliable evidence. Centralized, tamper-resistant logging defeats attackers who try to erase local traces, and alerting turns raw data into timely action. The Linux skills in this module — logs, journal, processes, resources, timestamps — are the raw materials that monitoring systems and analysts depend on.
Common mistakes
- Monitoring without a baseline, so anomalies cannot be recognized.
- Relying on manual watching instead of alerting, which does not scale and misses events.
- Keeping logs only locally, letting an attacker erase evidence — centralize and protect them.
Key takeaways
- Continuous monitoring observes logs, processes, and resources over time against a baseline to catch faults and intrusions.
- It depends on watching the right signals, alerting on important conditions, and (at scale) centralizing data for correlation and tamper-resistance.
- Monitoring is the core of blue-team defense and the bridge to the SOC path; the module's Linux skills are the raw materials monitoring relies on.
Check your understanding
- Why is a baseline of normal behavior essential to effective monitoring?
- What are two advantages of centralizing logs and alerting rather than watching each host manually?