DevSecOps Practice Hub

Monitoring & Alerting

Track security-relevant signals and alert with enough context to act.

BeginnerMonitoringOperations

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Operate Runtime security, secrets rotation and configuration reconciliation.
  • Monitor Detection engineering, SIEM, compliance evidence and incident response.

Overview

Security monitoring watches signals such as authentication failure rates, policy violations, certificate expiry and scan coverage, and turns sustained anomalies into actionable alerts.

Why it matters

Controls that silently stop working are worse than no controls, because they create false confidence.

How it works

  1. 01Metrics are exported from security controls themselves.
  2. 02Alert rules use sustained thresholds to avoid flapping.
  3. 03Every alert links to a runbook.

Common tools

PrometheusGrafanaAlertmanagerKubernetesLinuxAWS

Implementation examples

yamlAlert on failed logins
groups:  - name: security    rules:      - alert: HighAuthFailureRate        expr: sum(rate(auth_failures_total[5m])) > 5        for: 10m        labels: { severity: warning }        annotations:          runbook: https://runbooks.example.com/auth-failures
The `for` clause avoids paging on short bursts.

Best practices

  • Alert on control health, not only on attacks.
  • Attach a runbook to every alert.

Common mistakes

  • Alerting on raw counts, which flap constantly.