Question

Difficulty: MediumLog Analysis and SIEM Management

A security operations team is configuring a Security Information and Event Management (SIEM) data pipeline to handle heterogeneous syslog and event streams from enterprise endpoints, firewalls, and application servers. Place the following SIEM processing stages in the correct chronological order from initial data intake to analyst notification.

  1. 1Log Collection: Gathering raw event streams and unstructured log entries from endpoint agents, firewalls, and network devices.
  2. 2Log Parsing: Reading the unstructured raw text logs to identify and extract distinct data fields such as timestamps, IP addresses, and event IDs.
  3. 3Log Normalization: Mapping extracted fields to a common taxonomy and standard schema so logs from different vendors share uniform field names.
  4. 4SIEM Correlation: Applying rule-based logic and analytical algorithms across normalized log data from multiple sources to detect complex attack patterns.
  5. 5Alert Generation: Triggering automated notifications or SOC incident tickets when correlation rule conditions and risk thresholds are met.

Answer

The correct chronological sequence for processing logs within a SIEM pipeline is: Log Collection, Log Parsing, Log Normalization, SIEM Correlation, and Alert Generation.
The correct order follows the standard SIEM processing pipeline lifecycle: Raw log entries are first gathered during Log Collection. Once ingested, Log Parsing extracts discrete data elements from raw strings. Next, Log Normalization maps these parsed elements to a unified schema so logs from different vendors can be compared uniformly. SIEM Correlation then evaluates rules across the normalized event streams to detect multi-host or multi-step threats. Finally, Alert Generation triggers incident tickets and notifications for security analysts when correlation thresholds are matched.

Step-by-Step Solution

1
Identify the initial intake phase of raw log data from distributed security controls and endpoints.
Log Collection is established as the first stage.
Data must be gathered from source systems before any downstream processing or analysis can occur.
2
Determine how raw log strings are structured into key-value data elements.
Log Parsing follows collection.
Unstructured text entries must be parsed into distinct key-value pairs before standardizing field formats.
3
Standardize variable field naming conventions across diverse vendor logs.
Log Normalization follows parsing.
Mapping parsed fields to a unified data model allows the correlation engine to evaluate heterogeneous logs consistently.
4
Analyze cross-system normalized events against security logic rules.
SIEM Correlation follows normalization.
Correlation rules require standardized inputs from multiple log sources to detect multi-stage attack indicators.
5
Output security events requiring human intervention or automated incident response.
Alert Generation is the final stage.
Alerts and tickets are generated only after correlation logic identifies suspicious behavior matching defined thresholds.

Key Concept

SIEM Log Processing Pipeline Lifecycle
Rate this question