📡 SOC & Monitoring Certification · 2025

GIAC Continuous Monitoring Certification (GMON)

Design, implement, and operate continuous security monitoring programmes. GMON validates comprehensive knowledge of security architecture, network security monitoring, endpoint security, vulnerability management, SIEM/HIDS/NIDS deployment, SOC operations, and the automation techniques that underpin modern cyber defence and CDM/NSM programme implementation.

Security Monitoring SOC Operations SIEM NIDS & HIDS Endpoint Security Vulnerability Scanning Automation CDM/NSM

Enroll Now

Security Architecture & SOC DesignCDM/CSM architecture, SOC models, and analyst workflows

Network Security Monitoring (NSM)NIDS, packet analysis, traffic baselining, and threat hunting

Endpoint Security & HIDSAccount monitoring, configuration checking, and HIDS tuning

Vulnerability Management & AutomationScanning, prioritisation, SIEM integration, and automated response

Exam Questions

3 hrs

Duration

74%

Passing Score

GIAC

Certified

Why It's Critical

Continuous Monitoring Is the Backbone of Modern Cyber Defence

Threats dwell in networks for an average of 200+ days before detection. Continuous monitoring programmes reduce dwell time, enable faster response, and provide the visibility needed to detect and respond to attacks before they become breaches. GMON gives you the skills to build and run these programmes.

Trending

200+

Average Days Attackers Dwell Before Detection Without Monitoring

Continuous monitoring dramatically reduces attacker dwell time by providing real-time visibility across the network, endpoints, and accounts — turning a 200-day blind spot into rapid detection.

CDM/NSM

Directly Maps to Federal CDM and NSM Programme Requirements

GMON is aligned to Continuous Diagnostics and Mitigation (CDM) and Network Security Monitoring (NSM) programme frameworks — essential for government, defence, and regulated industries.

Trending

SIEM/HIDS

Covers SIEM, HIDS, and NIDS Deployment in Depth

GMON goes beyond theory — it covers the practical deployment and tuning of SIEM platforms, host-based intrusion detection systems, and network-based detection sensors.

Automation

Security Automation Skills Are Increasingly Mandatory

Security operations teams must automate to keep pace with threat volume. GMON teaches automation as a core capability, covering scripted response, automated vulnerability tracking, and intelligent alerting.

Course Content

Complete GMON Curriculum

Click any module to expand and explore the topics covered in detail.

Security Architecture, SOC Design & CDM/CSM Frameworks

5 Topics

Designing security operations centres (SOCs) including analyst roles, escalation paths, and tooling

Continuous Diagnostics and Mitigation (CDM) and Continuous Security Monitoring (CSM) programme frameworks

Understanding attack techniques and cyber kill chain to inform monitoring strategy

Configuration monitoring: baselining systems and detecting configuration drift

Device management monitoring: tracking and assessing managed and unmanaged assets continuously

Network Security Monitoring (NSM) & NIDS Deployment

5 Topics

Network Intrusion Detection Systems (NIDS) — deployment architecture, sensor placement, and tuning

Passive traffic analysis and network traffic baselining for anomaly detection

Cyber defence strategy and how NSM feeds into network-level threat hunting

Vulnerability scanning and network-level vulnerability management workflows

Identifying and investigating anomalous activity across network flows and packet captures

Endpoint Security Monitoring & HIDS

5 Topics

Host-based Intrusion Detection Systems (HIDS) — deployment, agent management, and alert tuning

Account monitoring: detecting abnormal account behaviour, privilege escalation, and lateral movement

Endpoint configuration compliance monitoring and automated remediation workflows

Log aggregation from endpoints: sources, formats, and normalisation for SIEM ingestion

Detecting malware persistence, process injection, and other endpoint-based attack techniques

SIEM, Vulnerability Management & Automation

5 Topics

Security Information and Event Management (SIEM) platform deployment, integration, and rule creation

Correlating events from network and endpoint sensors within SIEM to detect multi-stage attacks

Vulnerability scanning lifecycle: scanning, prioritisation, tracking, and remediation verification

Security automation concepts: automated alert response, scripted enrichment, and SOAR integration

Continuous monitoring programme metrics, reporting, and improvement cycles for SOC and executive audiences

FAQs

Frequently Asked Questions

What is the GIAC Continuous Monitoring Certification (GMON)?

GMON validates a practitioner's knowledge of continuous monitoring security architecture including Security Operations Centre (SOC) design, network security architecture and monitoring, and endpoint security architecture and automation. GMON-certified professionals can design, implement, and operate continuous monitoring programmes aligned to CDM and NSM frameworks.

What are the GMON exam requirements?

The GMON exam consists of 82 questions, is web-based and proctored, has a 3-hour time limit, and requires a minimum passing score of 74%. Proctoring is available via ProctorU (remote) or PearsonVUE (onsite).

What specific topics does GMON cover?

GMON covers account monitoring, attack techniques, configuration monitoring, continuous monitoring approaches, cyber defence strategies, device management monitoring, network intrusion detection, passive traffic analysis, security automation, SIEM deployment and correlation, HIDS deployment, vulnerability scanning, and network-level vulnerability management.

What is CDM and why is GMON aligned to it?

CDM (Continuous Diagnostics and Mitigation) is a US federal programme requiring agencies to continuously monitor their cyber risk posture. GMON's curriculum is directly aligned to CDM principles, making it highly valuable for government agencies, federal contractors, and organisations implementing CDM-aligned security programmes.

Who should take the GMON certification?

GMON is designed for CDM/CSM/NSM programme implementers, security architects, senior security engineers, SOC teams, and Cyber Network Defence (CND) analysts. It is ideal for professionals building or maturing enterprise security monitoring programmes in both public sector and large commercial environments.

How does GMON relate to SIEM and SOAR platforms?

GMON provides the foundation for understanding what SIEM platforms should be doing — how to architect data collection, define correlation rules, and interpret alerts. This makes GMON-certified professionals more effective at deploying, tuning, and operating commercial SIEM/SOAR products like Splunk, Microsoft Sentinel, IBM QRadar, and similar platforms.

Build World-Class Security Monitoring with GMON

Join Zetlan Technologies' GMON programme and develop the skills to design and operate continuous monitoring programmes that detect threats faster, reduce dwell time, and give your organisation sustained visibility into its security posture. Earn your GIAC certification.

GIAC Continuous Monitoring Certification (GMON)

Continuous Monitoring Is the Backbone of Modern Cyber Defence

GMON Exam Details

Complete GMON Curriculum

For SOC Teams, Security Architects & Monitoring Programme Leads

Frequently Asked Questions

Build World-Class Security Monitoring with GMON