Extended Monitoring Window
Definition
A defined period of heightened detection sensitivity following recovery, during which security operations maintain increased logging, alert thresholds, and analyst attention. Ends when all recurrence criteria are satisfied.
- Trigger
- Follows incident recovery
- Measures increased
- Logging, alert thresholds, analyst attention
- End condition
- All recurrence criteria satisfied
- Field
- Incident response, post-recovery validation
Common questions
Why extend monitoring after recovery instead of closing the incident once systems are restored?+
Restoration confirms systems are functioning, but not that the attacker's access has been fully removed. A dormant backdoor or missed persistence mechanism can reactivate, so heightened monitoring for a defined period checks for recurrence before formal closure.
What kind of criteria typically end an extended monitoring window?+
Criteria are case-specific but generally include a defined period with no recurrence indicators, confirmation that identified persistence mechanisms were removed, and validation that affected credentials and access paths were rotated or closed.
Related terms
- Baseline Comparison
- Comparison of a recovered system's current state, including running processes, network connections, scheduled tasks, and file hashes, against a known-good reference state...
- Honeytoken
- A synthetic credential, document, or data record placed in a monitored location. Any attempt to use or access the honeytoken is an...
- Recovery Validation
- The verification process that confirms a restored system is clean, correctly configured, and free from residual attacker access. Distinct from eradication, which...
- Recurrence
- Re-establishment of attacker access or re-execution of the same attack vector after the prior incident has been eradicated. Recurrence triggers the incident...
- Tripwire
- A deliberately placed artefact or detection rule designed to fire only if an attacker returns or residual malware reactivates. Examples include canary...