A city SOC manager treats continuous monitoring as the quarterly audit spreadsheet of civic systems reviewed last quarter. What should the defense analyst explain instead?
Select an answer to reveal the explanation.
Short Explanation
A quarterly spreadsheet is a photo album, not a security camera. Continuous monitoring is the camera still rolling—scheduled correlation searches and dashboards on civic telemetry, every hour, not every quarter. If it only wakes up for the audit, it is not continuous.
Full Explanation
In Splunk Enterprise Security, continuous monitoring is ongoing automated collection, analytics, and alerting against live civic telemetry. Scheduled correlation searches, risk rules, and built-in dashboards are how that watch stays up between incidents. A quarterly audit workbook is a compliance artifact; it does not detect or page on a treasurer account takeover at 02:00. Defense analysts should describe continuous monitoring as the always-on feed that later supplies investigation triggers, not as a periodic spreadsheet exercise.