SIEM

A SIEM (Security Information and Event Management) centralizes logs from across the organization, normalizes, correlates, and alerts. It’s the brain of the SOC (SOC operations): where telemetry (Sysmon & telemetry/Detection & logging) becomes actionable detection.

What a SIEM does

Ingest         collects logs from endpoints, network, identity, cloud, apps
Normalization  parses to a common schema (ECS, OCSF) -> cross-source correlation
Correlation    rules and analytics that join events ("4625 x50 then 4624" = successful brute force)
Alerting       generates prioritized cases/alerts for the analyst
Search         hunting and incident response over historical data (dfir)
Dashboards     visibility, metrics, and compliance

Platforms

Splunk        powerful, SPL as its language; market reference
Elastic/ELK   Elasticsearch+Kibana; widely used, flexible (detection rules)
Microsoft Sentinel  cloud-native SIEM on Azure, KQL; strong for M365/Azure
Wazuh         open-source (over OpenSearch), with HIDS/XDR capabilities
Chronicle, QRadar, etc.

Architecture and pipeline

Sources -> collectors (agents/forwarders) -> pipeline (parse/enrich) -> index -> detection
- enrichment: geoIP, threat intel (see cti-ioc), asset inventory, identity
- tiered retention (hot/cold) by cost and need for retrospective hunting
- time sync (NTP) essential to correlate across systems

Use cases (typical detections)

- brute force / password spraying (see ad-spray): many 4625 -> one 4624
- impossible travel / login from a new country (identity)
- suspicious execution (Sysmon 1 + anomalous command line, LOLBins)
- beaconing / odd domains (def-red, mal-c2)
- changes to privileged accounts, service creation, log clearing (1102)

Rules and detection-as-code

- Sigma as a neutral format -> convert to the specific SIEM's SPL/KQL/EQL
- version rules, review them, and test them (Atomic Red Team)
- continuous tuning: mass false positives are the SOC's biggest enemy

Blue Team / operation

Prioritize high-value sources first (identity, endpoint) over “log everything” without criteria.
Watch ingestion cost (volume-based licensing): filter/route the noisy stuff.
Integrate with SOAR for automated response (isolate host, disable account).
Mind clocks (NTP), retention, and the integrity/access of the SIEM itself (an attacker target).

Real-world cases

SolarWinds (2020) and many IRs: SIEM quality/retention decided whether the attack could be reconstructed.
Cases where the attacker cleared or blinded logging (event 1102) underscore immediate off-host forwarding.
Breaches caught by identity correlation (impossible travel, spraying) in environments with a good SIEM.

Testing checklist

High-value sources integrated (identity, endpoint, network, cloud)
Normalization to a common schema and enrichment (TI, assets)
Key correlation rules (spraying, impossible travel, LOLBins, 1102)
Sigma → translation to the SIEM’s language; rules versioned and tested
Retention adequate for hunting and IR
Correct NTP/time sync across all sources
SOAR integration and protection of the SIEM itself