knowledge

Overview

A Security Information and Event Management (SIEM) system collects logs and data from various endpoints and network devices, centralizes it, and performs correlation to identify suspicious or malicious activity. SIEMs automate the tedious process of manual log review and provide real-time monitoring, alerting, and historical investigation capabilities.

Terminology

TermDefinition
SIEMSecurity Information and Event Management; centralizes log collection and correlation
Log IngestionProcess of collecting and importing logs into the SIEM
Correlation RuleLogical expression that triggers an alert when specific conditions are met
Agent / ForwarderLightweight tool installed on endpoints to collect and forward logs to a SIEM
SyslogProtocol for sending real-time logs from systems to a central collector
DashboardCustomizable SIEM interface displaying alerts, metrics, and visualizations
Host-Centric LogLog capturing events on an individual host
Network-Centric LogLog capturing events from host communications or internet activity

Core Concepts

Key SIEM Features

FeatureDescription
Real-time log ingestionContinuously collects logs as events occur
AlertingNotifies analysts of abnormal or suspicious activity
24/7 monitoringProvides continuous visibility across the environment
Early threat detectionIdentifies indicators of compromise before damage escalates
Data visualizationDashboards surface patterns, trends, and anomalies
Post-incident investigationHistorical log storage enables forensic analysis

Network Visibility

Host-Centric Log Sources

Capture events occurring on individual hosts.

  • Windows Event Logs, Sysmon, Osquery
  • User authentication events
  • File access and modification
  • Process execution
  • Registry modifications
  • PowerShell execution

Network-Centric Log Sources

Capture events from host communications and internet activity.

  • SSH connections
  • FTP file access
  • Web traffic
  • VPN access
  • File sharing activity

Log Sources and Ingestion

Windows

Linux

  • Logs stored across specific directories by service type
Log PathPurpose
/var/log/httpdHTTP requests, responses, and errors
/var/log/cronCron job execution events
/var/log/auth.log or /var/log/secureAuthentication events
/var/log/kernKernel events
/var/log/apacheApache web server logs

See Linux Fundamentals for broader Linux log structure detail.

Web Servers

  • Logs available in standard server directories per web server type

Log Ingestion Methods

MethodDescription
Agent / ForwarderLightweight tool on endpoints; collects and forwards logs to SIEM
SyslogProtocol sending real-time logs to a central SIEM instance
Manual UploadIngests offline logs for analysis
Port ForwardingEndpoints forward logs to a SIEM listening on a specific port

SIEM Business Requirements

Business NeedDescription
Log Aggregation & NormalizationConsolidates data from disparate sources into a common field schema; improves threat visibility and enables correlation across datasets
Threat AlertingAdvanced analytics and threat intelligence enable faster, more targeted investigations and reduce mean time to detect
Contextualization & ResponseContext-driven filtering reduces alert volume and helps analysts distinguish true positives from noise
ComplianceRegulatory frameworks (PCI DSS, HIPAA, SOX) commonly mandate SIEM-level log collection, retention, and monitoring

Data Flow in a SIEM

  1. Ingest — Logs from endpoints, servers, network devices, and applications are collected via agents, Syslog, or API feeds
  2. Normalize — Raw logs from different sources are converted into a common field schema (data normalization and aggregation) so the SIEM engine can query them consistently
  3. Correlate and Detect — The SIEM applies detection rules, thresholds, and behavioral analytics against the normalized data
  4. Visualize and Act — SOC analysts work from dashboards, alerts, and incident workflows built on top of the correlated data

Analyzing Logs and Alerts

SIEM correlates ingested logs against rules defined by SOC analysts to surface actionable alerts.

Dashboard Views

Dashboards can be customized to display:

  • Alert highlights and triggered rules
  • System and health notifications
  • Failed login attempts
  • Event ingestion counts
  • Top visited domains

Correlation Rules

Logical expressions that trigger alerts when defined conditions are met.

Example ConditionAlert Triggered
5 failed logins within 10 secondsMultiple Failed Login Attempts
USB device connectedRemovable Media Inserted
WinEventLog + EventID 104Event Log Cleared
⚠︎Security Note

Log clearing (EventID 104) is a common post-exploitation action — a triggered alert here warrants immediate investigation

References / Images

  • SIEM dashboard and correlation rule examples
  • Windows Event Log and Linux log directory references