The top 5 alerts every organization needs to configure

According to IBM's Cost of a Data Breach Report 2022, the average time it takes to discover and contain a data breach is 277 days, and the global average total cost of a data breach was $4.35 million. The main reasons organizations take so long to detect malicious activities in their networks are poor management of log data and the lack of advanced techniques to spot anomalies. An efficient log management solution with alerting capabilities is what every organization needs.

Why are alerts important?

Receiving alerts when a critical event occurs is the first step in responding to a security incident. Alerts give real-time information of important events that are happening across your network. They help security teams detect and mitigate security threats at an early stage.

Here are the top five alerts every organization needs to set up to stay ahead of attackers in their network.

1. Logon and logoff events: Every attack will have a logon event inevitably at some point in their kill chain. We need to be able to answer the four Ws: who, what, when, and where. Who is logging on, what are they doing, when is this happening, and where is this happening from? We should also track these activities based on the system and the user. Although our focus should be mainly on critical systems, it's important to keep track of all the systems in the network. We need to keep a record of everything that is happening on the network, but we need to set alerts primarily for repeated logon failures and account lockouts.

2. System events: Anything that is happening on the system such as shutdowns, restarts, and process installations are system events. These are a broad spectrum of events that need to be tracked. Malicious activities almost always trigger system events. So, we need to be on the watch for suspicious activities like an unusual number of restarts in a small interval, and unexpected server shutdowns and restarts.

3. Data accesses and modifications: This involves the monitoring of files, folders, and databases, as we need to ensure the integrity of sensitive data. File integrity monitoring is done for files and folders, and column integrity monitoring is done for databases. We need to track every single access and modification made to sensitive data, have a record of the four vital W's, and set up alerts for unauthorized and suspicious activities.

4. Web server activities: It's necessary to track all the web server activities and have them on record for audit purposes and to go back and check if there's something wrong. This is to monitor who is visiting the site, the requests coming in, uploads, downloads, and so on. But alerts need to be set for tracking known attack patterns like SQL injections and XSS. An efficient SIEM solution would have these built-in patterns to detect such attacks.

5. Firewall traffic: We need to track all allowed and blocked connections, analyze the source, destination traffic, and protocol used. Tracking these will detect external attacks at an early stage. It is also important for forensic investigations. Above all, tracking firewall policy changes is crucial, and we need to set alerts for any firewall policy changes happening.

Apart from these five alerts, it is also important to monitor and set alerts for all the log management activities in your network and who has access to them, as all alerts are generated from log data.

A security information and event management solution like ManageEngine Log360 will enable you to manage and monitor your log data centrally and alert you about any important security incidents happening in your network in real time. As a result, it ensures quick detection of security threats and immediate responses to incidents. Schedule a personalized demo with our product experts to learn more about Log360.