Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security analyst is setting up a Security Information and Event Management (SIEM) pipeline to process incoming telemetry from enterprise web application firewalls. Arrange the stages of the SIEM log processing workflow in the correct operational sequence, from initial data receipt to incident notification.

  1. 1Log Collection (Inbound raw log data is gathered from sensor endpoints and sent to the SIEM receiver)
  2. 2Parsing (Unstructured log strings are broken down into distinct variables such as IP address, request method, and timestamp)
  3. 3Data Normalization (Extracted fields are mapped into a unified database taxonomy and standardized format)
  4. 4Event Correlation (Normalized logs are evaluated against predefined behavioral logic and cross-source rules)
  5. 5Alerting and Incident Generation (A security notification or ticket is dispatched to SOC analysts upon rule trigger)

Answer

The correct sequence for the SIEM log processing workflow is Log Collection, Parsing, Data Normalization, Event Correlation, and Alerting and Incident Generation.
The standard SIEM data pipeline follows a strict dependency hierarchy: Data must first be gathered (Collection), converted from raw text into structured attributes (Parsing), mapped to a single standard schema (Normalization), evaluated for multi-source indicators of compromise (Correlation), and finally communicated to security analysts when thresholds are breached (Alerting).

Step-by-Step Solution

1
Identify the initial ingestion mechanism
Log Collection is identified as position 1
Data must be transmitted from source devices and received by the SIEM before processing can begin.
2
Extract meaningful fields from the raw string payload
Parsing is identified as position 2
Unstructured log text must be split into readable key-value fields.
3
Standardize variable names and formats across heterogeneous sources
Data Normalization is identified as position 3
Different vendors use varying field labels; normalization creates a unified schema across all logs.
4
Compare normalized events across rule criteria and baselines
Event Correlation is identified as position 4
Correlation logic requires normalized data to associate events across multiple logs and devices.
5
Trigger SOC notification upon threat identification
Alerting and Incident Generation is identified as position 5
Alerting is the resulting action when correlation engine conditions are met.

Key Concept

SIEM Log Processing Pipeline Lifecycle
Estimated Time:1m 30s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic