--- title: Learning security monitoring through failure - Truls... description: A conference talk on security monitoring fundamentals and common mistakes, delivered with self-deprecating humor. Covers the SOC/SecOps ecosystem, SIEM vs data... canonical: https://daily.dev/posts/learning-security-monitoring-through-failure---truls-dahlsveen---ndc-security-2026-1fu8zgsdf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Learning security monitoring through failure - Truls Dahlsveen - NDC Security 2026 | daily.dev og:description: A conference talk on security monitoring fundamentals and common mistakes, delivered with self-deprecating humor. Covers the SOC/SecOps ecosystem, SIEM vs data... og:url: https://daily.dev/posts/learning-security-monitoring-through-failure---truls-dahlsveen---ndc-security-2026-1fu8zgsdf og:image: https://api.daily.dev/og/posts/1fu8ZGsdf.png og:image:alt: Learning security monitoring through failure - Truls Dahlsveen - NDC Security 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Learning security monitoring through failure - Truls Dahlsveen - NDC Security 2026 **[NDC Conferences](https://daily.dev/sources/ndc)** · 45 min read · 0 upvotes · 0 comments ## Summary A conference talk on security monitoring fundamentals and common mistakes, delivered with self-deprecating humor. Covers the SOC/SecOps ecosystem, SIEM vs data lakes, EDR/XDR tools, and real-world failures including runaway cloud logging costs (duplicate logs, unused data in expensive tiers), over-reliance on default detection templates causing alert fatigue or missed detections, and lack of context when onboarding new systems. Key lessons: reverse-engineer log requirements from what you want to detect rather than logging everything; customize detection templates rather than deploying them as-is; share context about what you're protecting with your security team; treat processes as changeable and encourage new team members to question existing workflows. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Essential Data Sources for Detection Beyond the Endpoint](https://daily.dev/posts/essential-data-sources-for-detection-beyond-the-endpoint-p1jtpqr3v) · Unit 42 · 0 upvotes · 0 comments - [Engineering for the Inevitable: Managing Downstream Failures in Security Data Pipelines](https://daily.dev/posts/engineering-for-the-inevitable-managing-downstream-failures-in-security-data-pipelines-yfalmb0zn) · Security Boulevard · 0 upvotes · 0 comments - [What an ex-NSA red teamer wants every SOC to stop doing](https://daily.dev/posts/what-an-ex-nsa-red-teamer-wants-every-soc-to-stop-doing-mmevqzeba) · The New Stack · 0 upvotes · 0 comments - [Is the End of Detection-Based Security Here?](https://daily.dev/posts/is-the-end-of-detection-based-security-here--zyigyehsi) · The New Stack · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/learning-security-monitoring-through-failure---truls-dahlsveen---ndc-security-2026-1fu8zgsdf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Learning security monitoring through failure - Truls Dahlsveen - NDC Security 2026","url":"https://daily.dev/posts/learning-security-monitoring-through-failure---truls-dahlsveen---ndc-security-2026-1fu8zgsdf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/learning-security-monitoring-through-failure---truls-dahlsveen---ndc-security-2026-1fu8zgsdf"},"datePublished":"2026-03-24T11:13:33.708Z","dateModified":"2026-03-24T11:13:55.026Z","description":"A conference talk on security monitoring fundamentals and common mistakes, delivered with self-deprecating humor. Covers the SOC/SecOps ecosystem, SIEM vs data...","image":"https://i.ytimg.com/vi/rfGGrVWFtCs/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/rfGGrVWFtCs/sddefault.jpg","isAccessibleForFree":true,"articleSection":"NDC Conferences","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"NDC Conferences","logo":"https://media.daily.dev/image/upload/s--SiIyojEj--/f_auto/v1748760369/logos/ndc","url":"https://daily.dev/sources/ndc"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/learning-security-monitoring-through-failure---truls-dahlsveen---ndc-security-2026-1fu8zgsdf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT45M","video":{"@type":"VideoObject","name":"Learning security monitoring through failure - Truls Dahlsveen - NDC Security 2026","description":"A conference talk on security monitoring fundamentals and common mistakes, delivered with self-deprecating humor. Covers the SOC/SecOps ecosystem, SIEM vs data...","thumbnailUrl":"https://i.ytimg.com/vi/rfGGrVWFtCs/sddefault.jpg","uploadDate":"2026-03-24T11:13:33.708Z","duration":"PT45M","url":"https://api.daily.dev/r/1fu8ZGsdf","embedUrl":"https://www.youtube.com/embed/rfGGrVWFtCs"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"NDC Conferences","item":"https://daily.dev/sources/ndc"},{"@type":"ListItem","position":3,"name":"Learning security monitoring through failure - Truls Dahlsveen - NDC Security 2026"}]} ```