Auditing

Question 1

What is Logging?

Answer 1

Logging is the process of generating log entries. Logging defines what generates entries,
where they are written to, and how they are retained or rotated. It’s is the task of recording data about events that take place on a system. The active recording of any information is logging.
Uses:
- Used to record program events for debugging
- System level events for maintenance or security

Question 2

What is Auditing?

Answer 2

Auditing is the process of reviewing the records for a given period. auditing logs involves taking an initial event (usually an indicator of compromise) and reviewing every log entry generated withing a specified amount of time before and after the initial event. It’s the inspection of information to determine actions, whether it’s for answering questions or to verify the state of a system.
Uses:
- Review and analysis of logs
- Answer the who, what and when questions.

Question 3

What is Monitoring?

Answer 3

Monitoring is the continuous real-time or near real-time analysis of log events as they are
recorded. Usually automated using a Security Event Information
Management (SEIM) system, which would allow for rapid detection of
potential incident.