Information Security Management, 2nd Edition

11.3 Cybermonitoring and Scanning Systems

A variety of activity monitors are used for different technologies and processes. Infrastructure monitors, such as Zabbix^®, are useful for reporting the functional state of servers and services and identifying irregularities in network traffic, CPU utilization, and so forth. For instance, a sustained spike in network utilization would trigger an alert for administrators to investigate. Other monitors such as BlueStripe^® work with applications and application workflows to trace transaction failures. Intrusion detection systems (IDSs), however, have a specialized purpose—to alert on certain types of security breach attempts. Most IDSs are not only designed to detect intrusions but also to protect systems ...