{"id":993,"date":"2016-02-24T18:29:01","date_gmt":"2016-02-25T02:29:01","guid":{"rendered":"http:\/\/raffy.ch\/blog\/?p=993"},"modified":"2017-02-26T15:19:21","modified_gmt":"2017-02-26T23:19:21","slug":"what-would-the-most-mature-security-monitoring-setup-look-like","status":"publish","type":"post","link":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/","title":{"rendered":"What Would The Most Mature Security Monitoring Setup Look Like"},"content":{"rendered":"<p>Okay, this post is going to be a bit strange. It&#8217;s a quick brain dump from a technical perspective, what it would take to build the <strong>perfect security monitoring environment<\/strong>.<\/p>\n<p>We&#8217;d need data and contextual information to start with:<\/p>\n<p>Any <strong>data<\/strong>:<\/p>\n<ul>\n<li>infrastructure \/ network logs (flows, dns, dhcp, proxy, routing, IPS, DLP, &#8230;)<\/li>\n<li>host logs (file access, process launch, socket activity, etc.)<\/li>\n<li>HIPS, anti virus, file integrity<\/li>\n<li>application logs (Web, SAP, HR, &#8230;)<\/li>\n<li>metrics<\/li>\n<li>configuration changes (host, network equipment, physical access, applications)<\/li>\n<li>indicators of compromise (threat feeds)<\/li>\n<li>physical access logs<\/li>\n<li>cloud instrumentation data<\/li>\n<li>change tickets<\/li>\n<li>incident information<\/li>\n<\/ul>\n<p>Any <strong>context<\/strong>:<\/p>\n<ul>\n<li>asset information and classification<\/li>\n<li>identity context (roles, etc.)<\/li>\n<li>information classification and location (tracking movement?)<\/li>\n<li>HR \/ presonell information<\/li>\n<li>vulnerability scans<\/li>\n<li>configuration information for each machine, network device, and application<\/li>\n<\/ul>\n<p>With all this information, what are the <strong>different jobs \/ tasks \/ themes<\/strong> that need to be covered from a data consumption perspective?<\/p>\n<ul>\n<li>situational awareness \/ dashboards<\/li>\n<li>alert triage<\/li>\n<li>forensic investigations<\/li>\n<li>metric generation from raw logs \/ mapping to some kind of risk<\/li>\n<li>incident management \/ sharing information \/ collaboration<\/li>\n<li>hunting<\/li>\n<li>running models on the data (data science)<\/li>\n<li>\n<ul>\n<li>anomaly detection<\/li>\n<li>behavioral analysis<\/li>\n<li>scoring<\/li>\n<\/ul>\n<\/li>\n<li>reports (PDF, HTML)<\/li>\n<li>real-time matching against high volume threat feeds<\/li>\n<li>remediating security problems<\/li>\n<li>continuous compliance<\/li>\n<li>controls verification \/ audit<\/li>\n<\/ul>\n<p>What would the right <strong><a href=\"\">data store<\/a><\/strong> look like? What would its capabilities be?<\/p>\n<ul>\n<li>storing any kind of data<\/li>\n<li>kind of schema less but with schema on demand<\/li>\n<li>storing event data (time-stamped data, logs)<\/li>\n<li>storing metrics<\/li>\n<li>fast random access of small amounts of data, aka search<\/li>\n<li>analytical questions<\/li>\n<li>looking for &#8216;patterns&#8217; in the data &#8211; maybe something like a computer science grammar that defines patterns<\/li>\n<li>building dynamic context from the data (e.g., who was on what machine at what time)<\/li>\n<li>anonymization<\/li>\n<\/ul>\n<p>Looks like there would probably be different data stores: We&#8217;d need an index, probably a graph store for complex queries, a columnar store for the analytical questions, pre-aggregated data to answer some of the common queries, and the raw logs as well. Oh boy \ud83d\ude09<\/p>\n<p>I am sure I am missing a bunch of things here. Care to comment?<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Okay, this post is going to be a bit strange. It&#8217;s a quick brain dump from a technical perspective, what it would take to build the perfect security monitoring environment. We&#8217;d need data and contextual information to start with: Any data: infrastructure \/ network logs (flows, dns, dhcp, proxy, routing, IPS, DLP, &#8230;) host logs [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,8,35],"tags":[],"class_list":["post-993","post","type-post","status-publish","format-standard","hentry","category-log-analysis","category-security-information-management","category-security-intelligence"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"Okay, this post is going to be a bit strange. It&#039;s a quick brain dump from a technical perspective, what it would take to build the perfect security monitoring environment. We&#039;d need data and contextual information to start with: Any data: infrastructure \/ network logs (flows, dns, dhcp, proxy, routing, IPS, DLP, ...) host logs\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Raffael Marty\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Future of Tech and Security: Strategy &amp; Innovation with Raffy \u2013 Insights at the intersection of cybersecurity, strategy, and innovation.\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"What Would The Most Mature Security Monitoring Setup Look Like \u2013 Future of Tech and Security: Strategy &amp; Innovation with Raffy\" \/>\n\t\t<meta property=\"og:description\" content=\"Okay, this post is going to be a bit strange. It&#039;s a quick brain dump from a technical perspective, what it would take to build the perfect security monitoring environment. We&#039;d need data and contextual information to start with: Any data: infrastructure \/ network logs (flows, dns, dhcp, proxy, routing, IPS, DLP, ...) host logs\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2025\/09\/ogimage.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2025\/09\/ogimage.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"512\" \/>\n\t\t<meta property=\"og:image:height\" content=\"512\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2016-02-25T02:29:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2017-02-26T23:19:21+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@raffaelmarty\" \/>\n\t\t<meta name=\"twitter:title\" content=\"What Would The Most Mature Security Monitoring Setup Look Like \u2013 Future of Tech and Security: Strategy &amp; Innovation with Raffy\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Okay, this post is going to be a bit strange. It&#039;s a quick brain dump from a technical perspective, what it would take to build the perfect security monitoring environment. We&#039;d need data and contextual information to start with: Any data: infrastructure \/ network logs (flows, dns, dhcp, proxy, routing, IPS, DLP, ...) host logs\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@raffaelmarty\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2025\/09\/ogimage.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2016\\\/02\\\/24\\\/what-would-the-most-mature-security-monitoring-setup-look-like\\\/#blogposting\",\"name\":\"What Would The Most Mature Security Monitoring Setup Look Like \\u2013 Future of Tech and Security: Strategy & Innovation with Raffy\",\"headline\":\"What Would The Most Mature Security Monitoring Setup Look Like\",\"author\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/author\\\/raffy\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/#person\"},\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2016\\\/02\\\/24\\\/what-would-the-most-mature-security-monitoring-setup-look-like\\\/#articleImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1a1923877d9dbd00d99847074d62faab586cce0a9ee6a4c85e8bb7c46d7418ac?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Raffael Marty\"},\"datePublished\":\"2016-02-24T18:29:01-06:00\",\"dateModified\":\"2017-02-26T15:19:21-06:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2016\\\/02\\\/24\\\/what-would-the-most-mature-security-monitoring-setup-look-like\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2016\\\/02\\\/24\\\/what-would-the-most-mature-security-monitoring-setup-look-like\\\/#webpage\"},\"articleSection\":\"Log Analysis, Security Information Management, Security Intelligence\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2016\\\/02\\\/24\\\/what-would-the-most-mature-security-monitoring-setup-look-like\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/raffy.ch\\\/blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/category\\\/log-analysis\\\/#listItem\",\"name\":\"Log Analysis\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/category\\\/log-analysis\\\/#listItem\",\"position\":2,\"name\":\"Log Analysis\",\"item\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/category\\\/log-analysis\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2016\\\/02\\\/24\\\/what-would-the-most-mature-security-monitoring-setup-look-like\\\/#listItem\",\"name\":\"What Would The Most Mature Security Monitoring Setup Look Like\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2016\\\/02\\\/24\\\/what-would-the-most-mature-security-monitoring-setup-look-like\\\/#listItem\",\"position\":3,\"name\":\"What Would The Most Mature Security Monitoring Setup Look Like\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/category\\\/log-analysis\\\/#listItem\",\"name\":\"Log Analysis\"}}]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/#person\",\"name\":\"Raffael Marty\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2016\\\/02\\\/24\\\/what-would-the-most-mature-security-monitoring-setup-look-like\\\/#personImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1a1923877d9dbd00d99847074d62faab586cce0a9ee6a4c85e8bb7c46d7418ac?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Raffael Marty\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/author\\\/raffy\\\/#author\",\"url\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/author\\\/raffy\\\/\",\"name\":\"Raffael Marty\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2016\\\/02\\\/24\\\/what-would-the-most-mature-security-monitoring-setup-look-like\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1a1923877d9dbd00d99847074d62faab586cce0a9ee6a4c85e8bb7c46d7418ac?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Raffael Marty\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2016\\\/02\\\/24\\\/what-would-the-most-mature-security-monitoring-setup-look-like\\\/#webpage\",\"url\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2016\\\/02\\\/24\\\/what-would-the-most-mature-security-monitoring-setup-look-like\\\/\",\"name\":\"What Would The Most Mature Security Monitoring Setup Look Like \\u2013 Future of Tech and Security: Strategy & Innovation with Raffy\",\"description\":\"Okay, this post is going to be a bit strange. It's a quick brain dump from a technical perspective, what it would take to build the perfect security monitoring environment. We'd need data and contextual information to start with: Any data: infrastructure \\\/ network logs (flows, dns, dhcp, proxy, routing, IPS, DLP, ...) host logs\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2016\\\/02\\\/24\\\/what-would-the-most-mature-security-monitoring-setup-look-like\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/author\\\/raffy\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/author\\\/raffy\\\/#author\"},\"datePublished\":\"2016-02-24T18:29:01-06:00\",\"dateModified\":\"2017-02-26T15:19:21-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/\",\"name\":\"Cyber Security - Strategy and Innovation\",\"description\":\"Insights at the intersection of cybersecurity, strategy, and innovation.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/#person\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"What Would The Most Mature Security Monitoring Setup Look Like \u2013 Future of Tech and Security: Strategy & Innovation with Raffy","description":"Okay, this post is going to be a bit strange. It's a quick brain dump from a technical perspective, what it would take to build the perfect security monitoring environment. We'd need data and contextual information to start with: Any data: infrastructure \/ network logs (flows, dns, dhcp, proxy, routing, IPS, DLP, ...) host logs","canonical_url":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/#blogposting","name":"What Would The Most Mature Security Monitoring Setup Look Like \u2013 Future of Tech and Security: Strategy & Innovation with Raffy","headline":"What Would The Most Mature Security Monitoring Setup Look Like","author":{"@id":"https:\/\/raffy.ch\/blog\/author\/raffy\/#author"},"publisher":{"@id":"https:\/\/raffy.ch\/blog\/#person"},"image":{"@type":"ImageObject","@id":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/#articleImage","url":"https:\/\/secure.gravatar.com\/avatar\/1a1923877d9dbd00d99847074d62faab586cce0a9ee6a4c85e8bb7c46d7418ac?s=96&d=mm&r=g","width":96,"height":96,"caption":"Raffael Marty"},"datePublished":"2016-02-24T18:29:01-06:00","dateModified":"2017-02-26T15:19:21-06:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/#webpage"},"isPartOf":{"@id":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/#webpage"},"articleSection":"Log Analysis, Security Information Management, Security Intelligence"},{"@type":"BreadcrumbList","@id":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/raffy.ch\/blog#listItem","position":1,"name":"Home","item":"https:\/\/raffy.ch\/blog","nextItem":{"@type":"ListItem","@id":"https:\/\/raffy.ch\/blog\/category\/log-analysis\/#listItem","name":"Log Analysis"}},{"@type":"ListItem","@id":"https:\/\/raffy.ch\/blog\/category\/log-analysis\/#listItem","position":2,"name":"Log Analysis","item":"https:\/\/raffy.ch\/blog\/category\/log-analysis\/","nextItem":{"@type":"ListItem","@id":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/#listItem","name":"What Would The Most Mature Security Monitoring Setup Look Like"},"previousItem":{"@type":"ListItem","@id":"https:\/\/raffy.ch\/blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/#listItem","position":3,"name":"What Would The Most Mature Security Monitoring Setup Look Like","previousItem":{"@type":"ListItem","@id":"https:\/\/raffy.ch\/blog\/category\/log-analysis\/#listItem","name":"Log Analysis"}}]},{"@type":"Person","@id":"https:\/\/raffy.ch\/blog\/#person","name":"Raffael Marty","image":{"@type":"ImageObject","@id":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/#personImage","url":"https:\/\/secure.gravatar.com\/avatar\/1a1923877d9dbd00d99847074d62faab586cce0a9ee6a4c85e8bb7c46d7418ac?s=96&d=mm&r=g","width":96,"height":96,"caption":"Raffael Marty"}},{"@type":"Person","@id":"https:\/\/raffy.ch\/blog\/author\/raffy\/#author","url":"https:\/\/raffy.ch\/blog\/author\/raffy\/","name":"Raffael Marty","image":{"@type":"ImageObject","@id":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/1a1923877d9dbd00d99847074d62faab586cce0a9ee6a4c85e8bb7c46d7418ac?s=96&d=mm&r=g","width":96,"height":96,"caption":"Raffael Marty"}},{"@type":"WebPage","@id":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/#webpage","url":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/","name":"What Would The Most Mature Security Monitoring Setup Look Like \u2013 Future of Tech and Security: Strategy & Innovation with Raffy","description":"Okay, this post is going to be a bit strange. It's a quick brain dump from a technical perspective, what it would take to build the perfect security monitoring environment. We'd need data and contextual information to start with: Any data: infrastructure \/ network logs (flows, dns, dhcp, proxy, routing, IPS, DLP, ...) host logs","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/raffy.ch\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/#breadcrumblist"},"author":{"@id":"https:\/\/raffy.ch\/blog\/author\/raffy\/#author"},"creator":{"@id":"https:\/\/raffy.ch\/blog\/author\/raffy\/#author"},"datePublished":"2016-02-24T18:29:01-06:00","dateModified":"2017-02-26T15:19:21-06:00"},{"@type":"WebSite","@id":"https:\/\/raffy.ch\/blog\/#website","url":"https:\/\/raffy.ch\/blog\/","name":"Cyber Security - Strategy and Innovation","description":"Insights at the intersection of cybersecurity, strategy, and innovation.","inLanguage":"en-US","publisher":{"@id":"https:\/\/raffy.ch\/blog\/#person"}}]},"og:locale":"en_US","og:site_name":"Future of Tech and Security: Strategy &amp; Innovation with Raffy \u2013 Insights at the intersection of cybersecurity, strategy, and innovation.","og:type":"article","og:title":"What Would The Most Mature Security Monitoring Setup Look Like \u2013 Future of Tech and Security: Strategy &amp; Innovation with Raffy","og:description":"Okay, this post is going to be a bit strange. It's a quick brain dump from a technical perspective, what it would take to build the perfect security monitoring environment. We'd need data and contextual information to start with: Any data: infrastructure \/ network logs (flows, dns, dhcp, proxy, routing, IPS, DLP, ...) host logs","og:url":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/","og:image":"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2025\/09\/ogimage.png","og:image:secure_url":"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2025\/09\/ogimage.png","og:image:width":512,"og:image:height":512,"article:published_time":"2016-02-25T02:29:01+00:00","article:modified_time":"2017-02-26T23:19:21+00:00","twitter:card":"summary","twitter:site":"@raffaelmarty","twitter:title":"What Would The Most Mature Security Monitoring Setup Look Like \u2013 Future of Tech and Security: Strategy &amp; Innovation with Raffy","twitter:description":"Okay, this post is going to be a bit strange. It's a quick brain dump from a technical perspective, what it would take to build the perfect security monitoring environment. We'd need data and contextual information to start with: Any data: infrastructure \/ network logs (flows, dns, dhcp, proxy, routing, IPS, DLP, ...) host logs","twitter:creator":"@raffaelmarty","twitter:image":"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2025\/09\/ogimage.png"},"aioseo_meta_data":{"post_id":"993","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2021-06-08 17:16:08","updated":"2025-06-12 20:15:34","focus_keyword":null,"additional_keywords":null,"truseo_locale":null,"seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/raffy.ch\/blog\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/raffy.ch\/blog\/category\/log-analysis\/\" title=\"Log Analysis\">Log Analysis<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tWhat Would The Most Mature Security Monitoring Setup Look Like\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/raffy.ch\/blog"},{"label":"Log Analysis","link":"https:\/\/raffy.ch\/blog\/category\/log-analysis\/"},{"label":"What Would The Most Mature Security Monitoring Setup Look Like","link":"https:\/\/raffy.ch\/blog\/2016\/02\/24\/what-would-the-most-mature-security-monitoring-setup-look-like\/"}],"_links":{"self":[{"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/posts\/993","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/comments?post=993"}],"version-history":[{"count":8,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/posts\/993\/revisions"}],"predecessor-version":[{"id":1008,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/posts\/993\/revisions\/1008"}],"wp:attachment":[{"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/media?parent=993"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/categories?post=993"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/tags?post=993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}