Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

A Security Operations Center (SOC) engineering team is designing an enterprise SIEM processing architecture to handle unstructured log streams from hybrid cloud applications, perimeter firewalls, and endpoint agents. In what order should the log processing pipeline execute these stages from initial log retrieval to automated response handling?

  1. 1Log Ingestion: Collecting raw log payloads from heterogeneous forwarders, agents, and API streams at the central log collector.
  2. 2Parsing and Normalization: Breaking down raw string payloads into key-value pairs and mapping disparate vendor attributes to a unified log schema (e.g., OCSF).
  3. 3Contextual Enrichment: Appending threat intelligence indicators, geolocation data, and asset criticality metadata to normalized event records.
  4. 4Cross-Source Correlation: Evaluating multi-source normalized events against behavioral rule logic and time-window thresholds to identify multi-stage attack patterns.
  5. 5Alerting and Orchestration: Triggering high-priority security notifications and executing automated SOAR playbooks based on validated incident thresholds.

Answer

The correct sequence of the SIEM log processing pipeline is: Log Ingestion, Parsing and Normalization, Contextual Enrichment, Cross-Source Correlation, and Alerting and Orchestration.
The standard SIEM data pipeline processes incoming events sequentially: first ingesting raw log data, parsing it into a normalized schema, enriching the normalized fields with context (such as threat intelligence and asset metadata), correlating the enriched events across sources using defined rules, and finally alerting analysts or triggering SOAR automation.

Step-by-Step Solution

1
Identify the initial collection phase
Log Ingestion (item 1) receives raw telemetry from agents, syslog streams, and APIs into the central SIEM receiver.
Data must be ingested into the pipeline before any transformation or inspection can occur.
2
Structure and format the raw log payload
Parsing and Normalization (item 2) converts unstructured strings into standardized key-value pairs using a common schema.
Downstream processing requires consistent attribute naming (e.g., src_ip, user_id) across different vendor log formats.
3
Augment normalized logs with external and environmental context
Contextual Enrichment (item 3) attaches threat intelligence feeds, asset values, and IP geolocation to normalized events.
Enrichment adds necessary risk scoring and IP reputation metadata to standardized fields prior to complex rule evaluation.
4
Analyze events across multiple log sources for threat patterns
Cross-Source Correlation (item 4) compares enriched, normalized events against temporal rules and behavioral logic.
Correlation requires clean, normalized, and enriched data across disparate sources within specific time windows to detect complex attacks.
5
Take action on correlated security events
Alerting and Orchestration (item 5) dispatches incident tickets and initiates automated playbooks.
Response actions and analyst alerts are executed only after correlation rules determine a high-fidelity security incident.

Key Concept

SIEM Log Processing Pipeline Sequence
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic