Real-time Security Monitoring Guide

Learn about security monitoring features that detect and respond to threats within servers in real-time through GIIP agents.

📋 Overview

Real-time Security Monitoring collects and analyzes security events occurring across the infrastructure on a second-by-second basis. Based on collected logs, the AI agent immediately reports signs of abnormal access or malicious code execution to administrators.

🛡️ Key Detection Items

1. Anomaly Process Detection

Detects processes that exhibit unusual CPU/Memory usage patterns or perform actions similar to known malicious code.

2. Abnormal Login Attempts

Detects and triggers warnings for repeated login failures within a short period (Brute-force) or access attempts from unauthorized IP ranges.

3. File Integrity Monitoring

Tracks in real-time whether important configuration files, such as /etc/passwd or system executables, are changed without user approval.

🔍 Using the Monitoring Screen

• Threat Level: Displays detected threats categorized into Critical, High, Medium, and Low levels.
• Real-time Log Stream: Check system logs related to security currently occurring on the server in real-time.

🛠️ Responsive Actions

• Process Isolation: Immediately terminate or isolate processes where threats are detected by clicking them.
• Alarm Setup: Be promptly notified of security threat situations via email, Slack, or web push.

💡 Important Notes

• To use real-time security features smoothly, the latest version of the [GIIP Agent] must be installed on each server.

🔧 Troubleshooting

Symptom	Cause	Solution
No data appears in the real-time log stream	The GIIP Agent is not installed or is outdated on the server	Install the latest version of the GIIP Agent on each server.
No alarm is received even when a threat occurs	No alarm channel has been configured	Check and enable email, Slack, or web push alarm settings.
A normal process is repeatedly flagged as an anomaly	Unusual CPU/Memory usage patterns are classified as a threat	Check the threat level (Low/Medium) to determine whether it is legitimate.
Login failure warnings keep appearing	Repeated login failures in a short period (Brute-force) or access from unauthorized IPs	Verify the source IP range and block abnormal access.

---

Version: 1.0 Last Updated: 2026-03-19 Source: giipv3/public/help/real-time-security.en.md