Monitoring and detection
Logs, SIEM, EDR, SOC, MITRE ATT&CK: why attacks go unnoticed for days on end, and how an SME can organise its threat detection in practice.
Presented byBelinda
9 min readUpdated on 2 October 2026What you will learn
- Understand why attackers often stay for days, or even months, without being seen
- Know which logs to collect, how to protect them and how long to keep them
- Tell SIEM, EDR, XDR, SOC and MDR apart, and choose between in-house and outsourced monitoring
- Use MITRE ATT&CK to measure what you can detect, and what slips past you
- Reduce alert fatigue and track indicators such as MTTD and MTTR
- Build a realistic detection plan for an SME
Free chapter with your account
Chapter 1 is free to read. Chapters 2 to 21, like the Junior, Senior and Expert levels of the Cyber Quiz, are free too: all you need is a free KrakenShield account with a confirmed email address.
Checking your access…
This content is temporarily unavailable. Please try again in a moment.
