Monitoring and Threat Detection

Monitoring and threat detection are the eyes and ears of network security architecture. Without continuous visibility into network traffic, device behaviour, and user activity, even the best-designed architecture is blind to attacks in progress. Detection must be built into the architecture — not bolted on as an afterthought.

---

Why Monitoring is an Architectural Concern

Monitoring is not just an operational activity — it must be designed into the network architecture from the start:

Architectural Decision	Monitoring Impact
Network zone boundaries	Detection points where IDS/IPS sensors are placed
Encryption strategy	Determines where traffic can be inspected
Logging infrastructure	Defines what data feeds the SIEM
Cloud vs. on-premises	Different monitoring tools and data sources
Microsegmentation	East-west visibility requirements

---

Monitoring Architecture

Monitoring Data Sources