<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-security-monitoring-architecture
description: >-
  Design and implement security monitoring architectures with centralized log collection,
  SIEM integration, detection engineering pipelines, alert triage workflows, and
  observability across cloud, network, endpoint, and application layers.
domain: cybersecurity
subdomain: security-architecture
tags:
  - security-monitoring
  - siem
  - log-management
  - detection-engineering
  - observability
  - alerting
  - threat-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Security Monitoring Architecture

## Overview

Security monitoring architecture provides the visibility foundation for threat detection
and incident response. This skill covers designing centralized log collection, SIEM
deployment, detection engineering pipelines, alert prioritization, and monitoring
coverage across all infrastructure layers.

Mode: `[MODE: BLUE]` — Defensive security architecture.

## Prerequisites

| Requirement | Details |
|---|---|
| SIEM platform (Splunk, Elastic Security, Microsoft Sentinel, or equivalent) | Required |
| Log shipping infrastructure (Fluentd, Vector, Filebeat) | Required |
| Detection rule framework (Sigma, KQL, SPL) | Required |
| Python 3.10+ | Required |

## Key Concepts

### Monitoring Architecture

```
┌──────────────────────────────────────────────────────────┐
│                 LOG SOURCES                                │
├──────────┬──────────┬──────────┬──────────┬──────────────┤
│ Cloud    │ Network  │ Endpoint │ App      │ Identity     │
│ CloudTrail│ Firewall │ EDR     │ App Logs │ Auth Logs    │
│ Flow Logs│ IDS/IPS  │ Syslog  │ WAF Logs │ Directory    │
│ Config   │ DNS      │ AV      │ API Logs │ MFA Events   │
├──────────┴──────────┴──────────┴──────────┴──────────────┤
│              LOG SHIPPING (Vector/Fluentd/Filebeat)       │
├──────────────────────────────────────────────────────────┤
│              LOG STORAGE (S3/Elasticsearch/Data Lake)     │
├──────────────────────────────────────────────────────────┤
│              SIEM / DETECTION ENGINE                      │
│  ┌────────────┬──────────────┬─────────────────────┐     │
│  │ Correlation│ Detection    │ Threat Intelligence  │     │
│  │ Rules      │ Analytics    │ Enrichment           │     │
│  └────────────┴──────────────┴─────────────────────┘     │
├──────────────────────────────────────────────────────────┤
│              ALERT TRIAGE & RESPONSE                      │
│  ┌────────────┬──────────────┬─────────────────────┐     │
│  │ SOAR       │ Ticketing    │ Runbooks             │     │
│  └────────────┴──────────────┴─────────────────────┘     │
└──────────────────────────────────────────────────────────┘
```

### Log Collection Configuration

```yaml
# Vector.toml — centralized log collection
[sources.cloudtrail]
type = "aws_s3"
bucket = "cloudtrail-logs"
region = "us-east-1"

[sources.syslog]
type = "syslog"
address = "0.0.0.0:514"
mode = "tcp"

[sources.kubernetes]
type = "kubernetes_logs"
auto_partial_merge = true

[transforms.parse_json]
type = "remap"
inputs = ["cloudtrail"]
source = '''
  . = parse_json!(.message)
  .timestamp = now()
  .source = "cloudtrail"
'''

[transforms.enrich]
type = "remap"
inputs = ["parse_json"]
source = '''
  .severity = if .errorCode != null { "high" } else { "info" }
  .mitre_tactic = classify_event(.eventName)
'''

[sinks.elasticsearch]
type = "elasticsearch"
inputs = ["enrich"]
endpoints = ["https://siem.internal:9200"]
index = "security-logs-%Y-%m-%d"

[sinks.s3_archive]
type = "aws_s3"
inputs = ["enrich"]
bucket = "security-log-archive"
key_prefix = "year=%Y/month=%m/day=%d/"
encoding.codec = "json"
```

### Detection Rule Pipeline

```bash
# Sigma rule → platform-specific query
# Install sigma CLI
pip install sigma-cli pySigma-backend-elasticsearch pySigma-backend-splunk

# Convert Sigma to Elasticsearch
sigma convert -t elasticsearch -p ecs_windows rules/

# Convert Sigma to Splunk SPL
sigma convert -t splunk -p splunk_cim rules/

# Convert Sigma to Microsoft Sentinel KQL
sigma convert -t microsoft365defender rules/
```

### Sample Detection Rules

```yaml
# Sigma — Suspicious PowerShell execution
title: Suspicious PowerShell Download Cradle
id: 3b6ab547-8ec2-4991-b5e2-1c3e1f2a3b4c
status: experimental
description: Detects PowerShell download cradle patterns
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - "powershell"
      - "IEX"
    CommandLine|contains:
      - "WebClient"
      - "DownloadString"
      - "Invoke-WebRequest"
  condition: selection
falsepositives:
  - Software deployment scripts using approved download patterns
level: high
tags:
  - attack.execution
  - attack.t1059.001
```

### Alert Prioritization Framework

```python
ALERT_PRIORITY = {
    "P1_critical": {
        "response_sla_minutes": 15,
        "criteria": [
            "Active data exfiltration",
            "Ransomware execution detected",
            "Privileged account compromise",
        ],
        "escalation": "Immediate page to incident commander",
    },
    "P2_high": {
        "response_sla_minutes": 60,
        "criteria": [
            "Lateral movement detected",
            "Malware on critical system",
            "Unauthorized admin access",
        ],
        "escalation": "SOC lead notification",
    },
    "P3_medium": {
        "response_sla_minutes": 240,
        "criteria": [
            "Suspicious authentication pattern",
            "Policy violation detected",
            "Vulnerability exploitation attempt",
        ],
        "escalation": "SOC queue",
    },
    "P4_low": {
        "response_sla_minutes": 1440,
        "criteria": [
            "Informational security event",
            "Compliance audit trigger",
        ],
        "escalation": "Batch review",
    },
}
```

## Workflow

### Step 1: Assess Monitoring Coverage

```bash
node scripts/agent.js --action assess --scope all
```

### Step 2: Design Log Architecture

```bash
node scripts/agent.js --action design --siem elastic --sources cloud,network,endpoint
```

### Step 3: Generate Detection Rules

```bash
node scripts/agent.js --action detections --framework sigma --output rules/
```

### Step 4: Validate Coverage

```bash
node scripts/agent.js --action coverage --rules rules/ --attack-matrix mitre
```

## Verification

- [ ] All critical log sources feeding centralized SIEM
- [ ] Log retention meets compliance requirements (min 90 days hot, 1 year cold)
- [ ] Detection rules cover MITRE ATT&CK top techniques
- [ ] Alert SLAs defined and monitored (P1 < 15 min)
- [ ] False positive rate < 10% for high-priority alerts
- [ ] Log integrity protected (immutable storage, checksums)
- [ ] SOAR playbooks automated for common alert types
- [ ] Monthly detection coverage review against ATT&CK matrix

## References

- [MITRE ATT&CK](https://attack.mitre.org/)
- [Sigma Detection Rules](https://github.com/SigmaHQ/sigma)
- [Elastic Security](https://www.elastic.co/security)
- [Vector Log Shipping](https://vector.dev/)
