In security operations, which statement best describes monitoring?

• A. Detection is ongoing observation of systems for anomalies
• B. Monitoring is ongoing observation of systems for anomalies
• C. Alerting is notifying when a detection criterion is met
• D. Monitoring is the analysis of data collected

Answer: (B)

Monitoring is the ongoing observation of systems for anomalies. It involves continuously collecting telemetry—logs, metrics, network data, and other signals—to maintain visibility across the environment and notice when something looks unusual. This creates the data foundation that allows detection to identify potential incidents and for alerts to be generated when criteria are met.

Think of it as the act of watching and gathering information so you can see what normal looks like and spot deviations. Detection is the analysis step that determines if those observations indicate a potential incident, and alerting is the notification that happens once a detection criterion is met. The idea that monitoring is simply analysis, or that detection is ongoing observation, mixes up the roles, and the statement about monitoring being the analysis or alerting being the description of monitoring doesn’t fit.

So, monitoring best describes the continuous observation of systems for anomalies.