Monitoring Strategy

Monitoring Strategy

Design security monitoring, alerting, and observability for "$ARGUMENTS". Define what to monitor, set alert thresholds and severity levels, and establish on-call procedures and response runbooks.

Prerequisites

Read .metapowers/security/$ARGUMENTS/00-govern.md. If this file does not exist, tell the user:

Phase 0 (Govern) has not been completed for "$ARGUMENTS". Run a Govern skill first (e.g., /security:security-policy $ARGUMENTS), or use --skip-checks to bypass.

If --skip-checks is present in $ARGUMENTS, skip this check and log to .metapowers/security/$ARGUMENTS/skip-log.md.

Process

1. Define what to monitor:

   • Authentication events — login successes and failures, MFA challenges, password resets, account lockouts
   • Authorization failures — access denied events, privilege escalation attempts, unauthorized API calls
   • Data access — sensitive data reads, bulk data exports, data modification patterns
   • Configuration changes — infrastructure changes, security group modifications, IAM policy updates
   • Network traffic anomalies — unusual outbound traffic, connections to known malicious IPs, DNS anomalies
   • Application-level events — error rate spikes, request pattern changes, resource exhaustion

2. Set alert thresholds and severity levels:

   • Critical (P1) — active breach indicators, data exfiltration detected, privilege escalation confirmed (response: immediate, 24/7)
   • High (P2) — multiple failed login attempts from single source, unauthorized configuration change, known malware signature (response: within 1 hour)
   • Medium (P3) — unusual access pattern, new admin account created, certificate expiring soon (response: within 4 hours)
   • Low (P4) — informational security events, policy compliance drift, minor configuration anomaly (response: next business day)
   • Define alert deduplication and correlation to reduce noise

3. Define on-call rotation and escalation:

   • Design on-call rotation schedule (primary and secondary responders)
   • Define escalation paths by severity (P1 escalates to security lead and CISO)
   • Set escalation timeouts (auto-escalate if not acknowledged within defined window)
   • Ensure coverage across time zones and holidays
   • Define communication channels per severity (PagerDuty, Slack, phone)

4. Choose monitoring stack:

   • Evaluate monitoring platforms (Datadog, Splunk, Elastic, CloudWatch, Grafana + Prometheus)
   • Define integration requirements with existing infrastructure
   • Plan metric collection, log aggregation, and trace correlation
   • Design dashboard hierarchy (executive overview, team-specific, service-specific)

5. Create runbooks for common alerts:

   • Write step-by-step response procedures for each alert type
   • Include investigation steps, containment actions, and escalation criteria
   • Define automated response actions for high-confidence detections
   • Link runbooks to alert configurations for quick access during incidents

6. Define SLOs for detection and response:

   • Mean time to detect (MTTD) targets by threat category
   • Mean time to respond (MTTR) targets by severity level
   • Alert accuracy targets (minimize false positive rate)
   • Coverage targets (percentage of critical systems monitored)
   • Define measurement and reporting cadence

7. Write the artifact to .metapowers/security/$ARGUMENTS/03-detect.md with heading:

   Monitoring Strategy

   Include sections:

   • Monitoring Scope — events and systems to monitor with rationale
   • Alert Thresholds — severity levels, thresholds, and response timeframes
   • On-Call and Escalation — rotation schedule and escalation paths
   • Monitoring Stack — selected tools and integration architecture
   • Runbooks — response procedures per alert type
   • Detection SLOs — MTTD, MTTR, accuracy, and coverage targets

Output

The monitoring strategy written to .metapowers/security/$ARGUMENTS/03-detect.md. Present a summary to the user highlighting:

• Key events and systems to be monitored
• Alert severity levels and response timeframes
• On-call structure and escalation paths
• Detection SLO targets