Overview
A SIEM (Security Information and Event Management) system is the SOC's central platform for collecting, analyzing, and alerting on logs. This lesson introduces SIEM concepts.
Learning objectives
- Define what a SIEM is and does.
- Explain the SIEM's role in the SOC.
- Preview the SIEM pipeline.
Core concept
A SIEM is a platform that centrally collects logs from across the environment, normalizes and stores them, correlates events, and alerts on suspicious activity — giving the SOC a single place to monitor and investigate. It's the SOC's core technology, tying together the log sources, telemetry, and normalization from earlier modules. A SIEM's pipeline typically is: ingestion (collect logs) → parsing/normalization (structure them) → correlation (rules linking events) → dashboards/alerts and queries (analyst interaction). By centralizing and correlating telemetry, the SIEM enables the SOC's detection and investigation at scale.
How it works
The SIEM sits at the center of the SOC's technology (from module 1's people/process/technology). It ingests logs from many sources, parses and normalizes them into a common structure (module 4), stores them (with retention), and applies correlation rules that link related events across sources to generate alerts. Analysts interact via dashboards (visual monitoring) and queries/searches (investigation). This centralization solves the problem that logs scattered across systems can't be monitored or correlated effectively — the SIEM brings them together, enabling cross-source detection and efficient investigation. It's the practical realization of the monitoring, telemetry, and normalization concepts built in prior modules, and the foundation for triage and detection modules ahead.
Practical example
A SOC deploys a SIEM as its central platform. Logs from authentication systems, endpoints, network devices, and servers all flow into it (ingestion), get normalized to a common structure, and are correlated by rules. When a rule matches suspicious cross-source activity, the SIEM raises an alert that appears on the analyst's dashboard. The analyst investigates using queries against the centralized logs. Without the SIEM, those logs would be scattered and un-correlated; the SIEM centralized them, enabling detection and investigation from one place — its core role in the SOC.
Cybersecurity relevance
The SIEM is the SOC's core technology: it centralizes logs from all sources, normalizes them, correlates events across sources, and generates alerts — enabling detection and investigation at scale and from one place. It realizes the monitoring/telemetry/normalization concepts of prior modules and underpins the triage, IOC, and detection modules ahead (analysts work primarily through the SIEM). Understanding the SIEM pipeline (ingestion → parsing → correlation → dashboards/queries) frames the rest of this module and much of SOC work. The SIEM turns scattered, heterogeneous logs into centralized, correlatable, actionable security data — central to the modern SOC.
Common mistakes
- Treating the SIEM as just log storage, ignoring its correlation/alerting role.
- Not understanding the SIEM pipeline, hampering effective use.
- Assuming the SIEM alone provides security without tuned rules, coverage, and analysts.
Key takeaways
- A SIEM centrally collects, normalizes, stores, correlates, and alerts on logs — the SOC's core technology, tying together log sources, telemetry, and normalization.
- Its pipeline: ingestion → parsing/normalization → correlation → dashboards/alerts and queries; analysts monitor via dashboards and investigate via queries.
- By centralizing and correlating telemetry, the SIEM enables cross-source detection and investigation at scale — foundational to the triage and detection modules ahead.
Check your understanding
- What does a SIEM do, and why is it the SOC's core technology?
- What are the stages of the SIEM pipeline?