TechKnowSurge
CompTIA CySA+ 1.1 CompTIA Security+ 4.4 NIST CSF DE.CM-01 NIST 800-53 SI-4 NIST CSF DE.CM-09 ISC2 CISSP 7.2
TechKnowSurge Catalog Videos Monitoring Methods
VideoSecurityFree

Monitoring Methods

Infrastructure monitoring relies on four core methods—capturing, scanning, probing, and logging—each serving a distinct role in maintaining visibility across a network environment. Together, these approaches form the foundation of a comprehensive monitoring strategy.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Infrastructure monitoring can be organized into four core methods: capturing, scanning, probing, and logging. Each method approaches visibility differently, and understanding the distinctions between them is essential for building a well-rounded monitoring strategy. Capturing is a passive technique that collects network packets as they travel across the network, then analyzes that traffic to identify patterns, anomalies, or security concerns. Scanning takes a more active stance, querying IP ranges to discover connected devices and running port scans to determine which services are exposed on each system. Probing goes a step further by pulling specific performance metrics directly from infrastructure components. For a given server, this might include CPU utilization, memory usage, storage capacity, and operating temperature—any measurable value that reflects the current state of the system. Logging, by contrast, focuses on recording discrete events as they occur, such as a user authentication attempt, creating a retrievable audit trail over time. In practice, these methods are often implemented through sensors—dedicated monitoring points assigned to individual resources like CPU, RAM, storage, or network interfaces—that continuously feed data into a centralized monitoring platform. Combining all four methods produces a comprehensive view of infrastructure health and activity.

What you'll learn

What's covered

Infrastructure Monitoring Methods

Aligned to

CompTIA CySA+
1.1 Explain the importance of system and network architecture concepts in security operations.
CompTIA Security+
4.4 Explain security alerting and monitoring concepts and tools.
NIST CSF
DE.CM-01 Networks and network services are monitored to find potentially adverse events.
DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events.
NIST 800-53
SI-4 System Monitoring
ISC2 CISSP
7.2 Conduct logging and monitoring activities

Key terms

Simple Network Management Protocol
SNMP
A protocol used to monitor and manage network devices such as routers, switches, and servers.
Packet
A unit of data formatted for transmission over a network, containing a header, payload, and sometimes a trailer.
Server
A computer or program that provides services or resources to other devices, known as clients, over a network.
Bandwidth
The maximum rate of data transfer across a network path, typically measured in bits per second.
Capturing
A passive monitoring method that collects and analyzes packets or data flowing across a network.
Scanning
An active monitoring method used to discover devices, open ports, or services across IP ranges on a network.
Polling
A monitoring method that actively queries devices or systems to retrieve resource metrics such as CPU usage, RAM, or temperature.
Logging
A monitoring method that records system or network events as they occur, creating an auditable history of activity.
Sensor
In an optical drive, the photodetector that receives laser light reflected off the disc surface; pits and lands reflect light differently, and the sensor converts those intensity variations into the binary ones and zeros the drive reads as data.

Topics

Infrastructure Monitoring Network Monitoring Packet Capture Network Scanning Snmp Polling Logging Sensors

Transcript

I've broken down monitoring into four different categories: we can capture, we can scan, we can probe, or we can log.

Capturing

Capturing is the idea that we're taking a little more of a passive approach. What I mean by that is we have information that's flowing back and forth across our network, we have packets that are flowing back and forth across our network. The idea behind capturing is we're going to capture some of that data, some of that information that's flowing, and then we're going to analyze that data, we're going to analyze those packets.

Scanning

Scanning is a little more of an active approach, and we may scan certain things. For instance, we may scan IP ranges. So if I'm on this laptop right here, I can scan the IP range and I can find different devices that are on this network right here. Or within each of these devices, maybe I do a port scan and I can scan ports on here. And so I can discover what is on my network by doing these scans.

Polling

Polling takes a little more in depth. For instance, let's say this is a server right here. Well, the server has CPU and it's running at a percent usage, so maybe it's running at 80% usage. And then there's RAM on this, and there's some sort of how much RAM is being utilized. So polling is the idea that I'm going to go and ask for some of this information, or be able to get some of this information: what is the CPU, what is the RAM, what's the temperature of this machine. Polling is maybe getting some sort of value out of something, like what is the CPU usage.

Logging

Logging is the idea that we are logging certain events that are happening. For instance, let's say this user logs into the system. Now what has been created is an event log of that event right there, and so now we have a record of it. So logging is the idea that we're creating records based off of some sort of event.

Sensors

For a lot of what we do, we can think of them as sensors. For instance, I've got a web server right here, and maybe I'm going to create a sensor that's going to be for the CPU, and then one for the RAM, and maybe one for some of the storage devices, maybe one for the networking on here. So we're going to create a sensor for each one of these that we're going to sense. We even maybe create a sensor for pinging this device to make sure that it's still up. Or maybe, since it's a web server, we're going to create an HTTP sensor that will sense if HTTP is up and running or not.

Ultimately, between all of these we can create a really robust monitoring system that's monitoring what's happening within our infrastructure.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →