monitoring
Let an agent explain monitoring as a practice, relay methods and standards across environmental, health, IT and security domains from reference sources, describe the security monitoring categories the registry aliases name without evasion or attack detail, and distinguish monitoring from inspection, evaluation, auditing and surveillance of individuals.
Bundle → Layer → Finding → Questions Filled
4 bundles · 8 layers · 8 findings · 16 questions
Understand What monitoring is.
Definition
Definition.
Definition
Definition.
- What is monitoring, and how does it differ from inspection, evaluation, auditing and surveillance of individuals? definition
- Is the question about a domain, a product category, or how to evade monitoring, which the model does not help with? boundary
Security
Security monitoring.
Security
Security.
- What are EDR, XDR, open and native XDR and MDR, at a general level? definition
- Which entry fits the specific category? action
Domains Domains.
Environment
Environmental monitoring.
Environment
Environment.
- How are air, water and ecosystems monitored? provenance
- Which references are standard? provenance
IT
IT and operations.
IT
IT.
- How do organisations monitor systems and networks, at a general level? provenance
- Which sources are cited? provenance
Governance Governance.
Standards
Standards.
Standards
Standards.
- What do ISO and sector standards require for monitoring? provenance
- Which entry fits security operations center? action
Privacy
Privacy.
Privacy
Privacy.
- What privacy limits apply to monitoring employees and users? provenance
- Which entry fits workplace surveillance? action
Context Evaluation and history.
Evaluation
Monitoring and evaluation.
Evaluation
Evaluation.
- How is monitoring and evaluation used in development programmes? provenance
- Which entry fits monitoring and evaluation? action
History
History.
History
History.
- How did security monitoring evolve from antivirus to XDR? provenance
- Which entry fits antivirus software? action
Classifiers Filled
- Family
- Thing Registry
- Category
- Activities and processes
- Entry kind
- thing
- Plane
- ACT
- Domain
- ACT.ACT
- Other names and narrower kinds
- extended detection and response, endpoint detection and response, Open Extended Detection and Response, Native Extended Detection and Response, XDR platform, managed detection and response, wastewater surveillance, health monitoring, sleep tracking, intraoperative monitoring, monitoring in clinical trials, prescription monitoring program
What it is Filled
The systematic observation and recording of a system, process, environment or condition over time to detect changes, problems or compliance, in fields from environmental and health monitoring to IT operations and cybersecurity, where security monitoring products include endpoint detection and response, extended detection and response or XDR platforms in native and open forms, and managed detection and response services; monitoring differs from one-off inspection and from surveillance of individuals, which raises privacy and legal issues.
Why it exists Filled
Let an agent explain monitoring as a practice, relay methods and standards across environmental, health, IT and security domains from reference sources, describe the security monitoring categories the registry aliases name without evasion or attack detail, and distinguish monitoring from inspection, evaluation, auditing and surveillance of individuals.
Distinguishing features Filled
- Continuous or periodic
- Detects change
- Many domains
- Privacy considerations
What robots and AI may and may not do Filled
Must not
- Monitor people beyond what they have been told and the law permits.
- Help evade security monitoring or detection.
- Disable or hide alerts without authorization.
- Repurpose monitoring data for unrelated uses such as profiling staff.
Only with a human decision
- Extending monitoring to employees, users or the public.
- Acting on monitoring data in decisions about people.
May
- Monitor systems, processes and environments the agent is authorized to watch, and report changes.
- Tune alerts so that real problems are not lost in noise.
Moral aspects Filled
- Monitoring protects systems and health, but over-monitoring violates privacy.
- Alert fatigue lets real failures slip past the people responsible.
Who is affected
- People being monitored
- Operators
- Users of the systems
Owners Filled
Steward
The operator of the monitored system.
Links to other meta-models Filled
parent
- Q193181 - registry parent class
related
- observation - in registry terms
- endpoint detection and response
- surveillance - of individuals
- incident response
What else AI and robots need to interact with it Filled
Identity and identifiers required Filled
- Vercy registry: vr.tr.monitoring
- Wikidata: Q2143522 (https://www.wikidata.org/wiki/Q2143522)
Direct properties not applicable Not applicable
- EDR term coined: 2013 year - Gartner
- XDR concept: about 2018 note
- monitoring cycle: collect, analyse, alert, respond list
Plane ACT: no invented physical properties.
Recognition optional Filled
- Ongoing observation and recording
- EDR, XDR platforms, open and native XDR, managed detection and response
- Inspection is one-off; evaluation judges results; auditing checks compliance; surveillance of individuals targets people
- Not a visible object; sensors, dashboards and logs.
Capabilities and actions required Filled
- explain the practice
- relay domains and standards
- describe security monitoring categories
- distinguish related practices
Hazards and failure modes required Filled
- Alert fatigue
- Privacy violations from over-monitoring
- Agents giving detection evasion detail
Standards and interfaces required Filled
- ISO/IEC 27001 monitoring controls
- Environmental monitoring regulations
- Privacy laws on employee and personal monitoring
Context of use required Filled
- Detecting change, problems and threats over time.
- environmental monitoring
- health and patient monitoring
- infrastructure and IT monitoring
- security monitoring including EDR, XDR and MDR
- programme monitoring and evaluation
Sources Filled
- Wikidata item Q2143522: monitoring - identity and sense of the item
- Wikipedia: Monitoring - general description of the item
Open questions
- Should XDR and EDR be separate primary entries?
- How should security and environmental sources be linked?
- The registry entry has merged aliases naming security product categories; should they be split off?
Machine files
Provenance
thing registry research (pass 2) · unreviewed
Built from: models/things/publications/thing-q2143522/spec.json