Issues of collecting information about security events from host information security tools as part of security monitoring

Currently, the role of the process of monitoring security events in information systems, including distributed information systems, is growing. Information security tools, including nodal information security tools, are the main sources of information security events for security monitoring systems. Not all nodal information security tools presented today are equally useful and informative as sources of information security events for monitoring systems. This study raises issues of assessing the effectiveness of nodal information security tools as sources of information security events. The proposed assessment of effectiveness is based on the analysis of the ability of nodal information security tools to detect various models of spreading the consequences of computer incidents, as well as on the ability to detect certain techniques and tactics of intruders, which they use to implement computer attacks that entail computer incidents. The following nodal means of information protection were considered within the framework of this study: information protection systems against unauthorized access, anti-virus information protection means, nodal systems for detection and prevention of intrusions, end device protection means, systems for automatic detection and elimination of malicious activity on end devices, integrity control systems, information leakage prevention systems. The formed assessment of the effectiveness of nodal means of information protection as sources of security events allows implementing a more effective information protection system and the process of monitoring security events by eliminating redundant information security events that can lead to false alarms and overload of monitoring systems. In addition, based on the methodology and analysis of existing types of nodal means of information protection, recommendations were formed aimed at increasing the level of protection of the information infrastructure of organizations, which contributes to the creation of a more adaptive and dynamic system of counteracting threats.