Data collection gathers security-relevant activity so teams can monitor threats and investigate incidents. Sources include network traffic, system logs, endpoint and application activity, and user behavior. Collection supplies the raw evidence; parsing, enrichment, correlation, and analysis turn it into findings. section 2.0 section 8.1.2
Set up collection around the decisions it needs to support:
- Define which systems and networks to monitor, which metrics matter, and how often to assess and report them. section 8.1 section 8.1.2
- Deploy sensors or agents across relevant endpoints, servers, and network devices. SIEMs, IDSs, and Wazuh are named collection options. section 2.0 section 8.1
- Analyze what was collected for patterns and anomalies, add context, and report findings with recommendations for mitigating risk. section 8.1.2
Tracing a financial institution breach
After unusual traffic revealed customer-data exfiltration, a security team used Wazuh and the Elastic Stack to gather system logs, network traffic, security alerts, server access logs, and firewall logs. Correlating login attempts with traffic showed substantial transfers to an external IP address. The evidence supported an attack timeline and identified a phishing-compromised credential and missing remote-access MFA as issues to address. section 9.5.1
Prioritize coverage that helps answer a risk question, not collection volume alone. The value of the data lies in timely detection, incident analysis, and clear findings that stakeholders can use to decide on corrective action. section 8.1.2 section 9.5
