Logging and Monitoring Security Events
Key Takeaways
Subdomain 5.2 names logging and monitoring security events.
A log is evidence only when it is reviewed, correlated, and acted on.
Triage ranks events by priority so that the important ones are handled first.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomain 5.2, checked 2026-10-22.
Logging and Monitoring
Subdomain 5.2, Understand security operations, names logging and monitoring security events. A log records what happened. Monitoring reviews those records as they arrive. The outline does not name specific detection products, so focus on what the record shows and who reviews it.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 5.2, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Triage and Correlation
The outline names security event triage with incident use cases, prioritization, and correlation. Correlation links related events, such as a failed login followed by a successful one from a new location. Prioritization decides which linked events a person reviews first.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 5.2: Logging and monitoring security events
- 5.2: Security event triage (e.g., incident use cases, prioritization, correlation)
- 5.2: Threat actors (e.g., types, motivations)
- 5.2: Cyber threat intelligence
- 5.2: Threat frameworks
Common Traps
A common trap is treating every alert as an emergency or every alert as noise. Triage ranks events by priority, scope, and correlation, and escalates the events that need a person.
A log shows several failed logins followed by one successful login from a new location. What activity does correlation help identify?
A related sequence of events that may need triage
A hardware warranty change logged by the vendor
A new exam fee posted on a certification website
A required retake of the exam after a failed attempt
Match each monitoring term to its meaning.
Match each item on the left with the correct item on the right
Logging
Triage
Correlation
Sections you finish are checked off in the contents.