Glossary: Logs and Data Sources for Investigations

Alert

Also written: alerts

A notice that fires in real time when a single event matches a rule, so someone can act on it. An example is Alex's SIEM alert for an SSH sign-in from outside the office.

Where the book teaches it

Chapter 1: Application, Authentication, Communication and Audit Logs
Chapter 3: Scans, Reports, Flow Records and Footage
Chapter 4: Security Tools, Dashboards, Packet Captures and Integrity

Related terms

Automated report Dashboard SIEM (security information and event management)