Security Event Monitoring with InfluxDB
Time series databases are a critical and natural solution for your security events and anomalies. Quickly inform the alerting and incident response process without having to dig into log files.
What is security event monitoring?
Security event monitoring provides real-time monitoring, correlation and expert analysis of activity in your environment, detecting and alerting on valid threats to your data and devices.
Why InfluxDB for security event monitoring?
Security monitoring is complex. Successful implementation of a security monitoring infrastructure involves people, process, technology and data, and requires multiple iterative phases to reach maturity. The data component comes from consuming log files from every possible asset, be it an application, database, virtual machine, operating system, server, network component, storage, even intelligent power strips. Log data from these assets will help with the following:
- Identifying security incidents
- Monitoring policy violations
- Establishing baselines
- Assisting non-repudiation controls
- Providing information about problems and unusual conditions
- Contributing additional application-specific data for incident investigation which is lacking in other log sources
- Helping defend against vulnerability identification and exploitation through attack detection
But log data on its own is not an efficient way of finding the anomalies and therefore, this data should be collected and organized in a collection of time series. This data set provides a way to correlate time series events that enable incident detection, response, remediation and forensics workflows to be timely and successful.
The functional architecture of the InfluxData security monitoring platform
Specific Telegraf components
Specific InfluxDB Templates
