A city SOC manager treats continuous monitoring as the quarterly audit spreadsheet of civic systems reviewed last quarter. What should the defense analyst explain instead?
Select an answer to reveal the explanation.
Short Explanation
A quarterly spreadsheet is a photo album, not a security camera. Continuous monitoring is the camera still rolling—scheduled correlation searches and dashboards on civic telemetry, every hour, not every quarter. If it only wakes up for the audit, it is not continuous.
Full Explanation
In Splunk Enterprise Security for a municipal SOC, continuous monitoring means ongoing automated collection, correlation, and visualization of civic telemetry—scheduled correlation searches, risk rules, and domain dashboards that watch permitting, finance, public-safety, and other municipal sources all the time. Treating last quarter's audit spreadsheet as continuous monitoring confuses a periodic compliance snapshot with always-on detection. A once-a-year tabletop fails by concept because an exercise proves readiness theater, not continuous telemetry watch. A help-desk survey of clerks who self-report suspicious email fails by concept because human self-reporting is lagging, incomplete, and not scheduled analytics on indexed events. An after-action report written only after ransomware ends fails by concept because it is post-incident documentation, not live monitoring that should have shortened dwell. Exam caveat: SPLK-5001 expects continuous monitoring as the always-on detection layer that feeds identify, not as audit spreadsheets, tabletops, surveys, or after-action reports. Operational check: list enabled correlation searches and Security Domain dashboards covering the city's critical sourcetypes, confirm they are scheduled and producing notables or risk, and show leadership that the quarterly spreadsheet is evidence of review—not the monitoring system itself.