SOC 2 CC7.2: System Operations - Monitoring of System Components for Anomalies

Deploy a centralised security monitoring platform. A SIEM or equivalent should aggregate logs from all critical systems: authentication, network, application, database, and cloud infrastructure. Configure correlation rules for patterns like brute-force attacks, privilege escalation, data exfiltration, and lateral movement.

Establish baselines for normal behaviour. Document expected patterns for network traffic, authentication activity, system resource usage, and application performance. Use these to set anomaly detection thresholds, and update them as your environment evolves.

Set up alerting for security-relevant anomalies. At minimum, alert on: multiple failed authentication attempts, access from unusual locations or times, privileged account anomalies, large or unusual data transfers, system configuration changes, malware detections, and availability threshold breaches.

Build a tiered alert management process. Categorise by severity and define response procedures for each tier. Critical alerts need immediate investigation. Lower-severity alerts can be reviewed in regular monitoring cycles. Ensure 24/7 coverage for critical alerts - either through an internal SOC, a managed security service provider, or automated response with on-call escalation.

Tune your monitoring rules regularly. False positives cause alert fatigue, which causes real threats to get missed. Review alert volumes, investigate false positive patterns, and refine rules to improve the signal-to-noise ratio. Track what percentage of alerts lead to genuine investigations.

Document everything. Keep records of alerts generated, investigations conducted, and outcomes. Report to management on monitoring coverage, alert trends, and security events detected. Use this data to keep improving the programme.