{
  "id": 20076744,
  "title": "Monitoring, Detection, and Response: The Watchers That Make Defence Possible",
  "url": "https://urgent.news/2026/11/14/monitoring-detection-and-response-the-watchers-that-make-defence",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-14T23:48:11.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/vickkykruz/monitoring-detection-and-response-the-watchers-that-make-defence-possible-1bfc"
  },
  "original_language": "en",
  "account": "The foundation of modern security is defence in depth, recognizing that no single safeguard can prevent breaches. The critical flaw lies in detecting these breaches in time, as an attacker inside a network does not issue notifications. This gap underscores the importance of visibility, which is the core focus of this post. All defensive measures are rendered useless if nobody is monitoring the network.\n\nTwo primary sources provide the raw data for monitoring: logs and traffic monitoring. Logs are the network's memory, recording system activities like user logins, connections, errors, and accessed resources. Though scattered across numerous devices, logs offer the richest source of information about network events when collected and analyzed. Traffic monitoring involves observing data flows across the network, including data sources, ports, volumes, and patterns. This offers a live view of the network's behavior, contrasting with the historical record provided by logs. However, raw data from these sources is overwhelming; it must be distilled into a baseline representing the normal network behavior, including traffic volumes, connection patterns, login times, and system activities. This baseline is crucial because deviations from it signal potential anomalies, such as attacks. Without a baseline, even significant irregularities would be indistinguishable from normal fluctuations.\n\nOnce a baseline is established, monitoring can effectively identify abnormal activities. This leads to detection and subsequent response. Intrusion Detection Systems (IDS) focus on alerting when anomalies are detected, but their alerts require human intervention to determine and respond to threats, potentially leaving a window of vulnerability. Intrusion Prevention Systems (IPS), on the other hand, can automatically block detected threats in real time, eliminating the delay between detection and mitigation. However, an IPS's automatic actions also pose significant risks. False positives, where legitimate traffic is mistakenly flagged as malicious, can disrupt services and user access. Moreover, an IPS integrated into the network's traffic flow can inadvertently cause network-wide outages if misconfigured, highlighting the need for careful deployment and calibration of IPS systems. Effective monitoring and detection systems are essential for recognizing and responding to attacks, turning seemingly invisible threats into visible patterns that can be managed and neutralized.",
  "summary": "In the last post we arrived at the central discipline of modern security: defence in depth, built on the assumption that no single wall holds, that breaches will happen, and that the job is to contain them when they do. But read that carefully and you will notice a promise we made and did not yet keep. To contain a breach, you have to know it is happening. And knowing is not automatic. An…",
  "key_points": [
    "Defence in depth requires detection of breaches, not just safeguards.",
    "Logs and traffic monitoring provide raw data for network visibility.",
    "Intrusion Prevention Systems can block threats automatically but risk false positives."
  ],
  "editors_take": "Establishing a behavioral baseline transforms overwhelming raw data into actionable intelligence, shifting the defensive focus from simple perimeter protection to the active identification of internal anomalies.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}