TOPIC SECURITY
SIEM centralized logging and alerting for security events
IN 10 SECONDS
A Security Information and Event Management (SIEM) system ingests logs from every source — cloud trails, firewall flows, server syslogs, app audit logs — normalizes them, and runs real-time correlation rules. When a rule fires (e.g., 'same user logs in from 2 continents in 5 minutes'), an alert is created for the SOC team to investigate.
GOTCHA SIEMs generate massive noise. Without careful tuning, 99% of alerts are false positives. Invest in log filtering, suppression rules, and a feedback loop where analysts tag false positives to improve detection.
HOW A SIEM PIPELINE WORKS
01 Log sources stream logs via syslog, CloudWatch, S3 events, or API to the SIEM collector.
02 Collector normalizes disparate formats (JSON, syslog key=value, Windows Event XML) into a common schema.
03 Detection engine runs hundreds of rules in real-time — signature-based (known IoCs), behavioral (anomalous volume), and threat-intel enriched.
04 SOC analyst triages alerts in a dashboard, pivots on IPs, users, and timestamps to determine if it's a real incident or a false positive.
POKE IT YOURSELF
wazuh-control status — check Wazuh SIEM agent status
splunk search 'index=aws sourcetype=cloudtrail eventName=ConsoleLogin' — search for AWS console logins in Splunk
Drill this topic →
~75 sec read