Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security analyst is defining operational procedures for a Security Information and Event Management (SIEM) deployment. Match each SIEM log management concept on the left with its correct operational description on the right.

  • Log AggregationCentralizing raw log data from disparate network hosts, firewalls, and endpoints into a single repository.
  • Log NormalizationTransforming heterogeneous log entries into a standardized schema with uniform field names and data types.
  • Event CorrelationAnalyzing relationship patterns between distinct log events across multiple systems to detect compound threats.
  • Log RetentionStoring historical log data for specified timelines to satisfy regulatory compliance and forensic requirements.

Answer

Log Aggregation matches centralizing raw log data from disparate hosts; Log Normalization matches transforming heterogeneous log entries into a standardized schema; Event Correlation matches analyzing relationship patterns between distinct log events; and Log Retention matches storing historical log data for specified timelines to satisfy regulatory requirements.
Each concept aligns with its precise SIEM function: Aggregation collects raw logs into a central location, Normalization standardizes field syntax across vendor logs, Correlation analyzes relationships across events to flag attacks, and Retention maintains historical log archives for compliance.

Step-by-Step Solution

1
Identify the mechanism for collecting raw logs centrally.
Centralizing raw log data from disparate systems corresponds to Log Aggregation.
Aggregation brings scattered log sources together into a central SIEM collector.
2
Identify the process for unifying varied log formats.
Transforming heterogeneous logs into a standardized schema corresponds to Log Normalization.
Normalization ensures that different log syntax structures share identical field names (e.g., standardizing 'src_ip', 'SourceAddress', and 'src' to a single common field).
3
Identify the analytical process for connecting multi-system events.
Analyzing relationships across distinct log entries corresponds to Event Correlation.
Correlation engine rules detect threat scenarios spanning multiple log sources across time windows.
4
Identify the policy governing historic data storage.
Storing historical logs to satisfy regulatory requirements corresponds to Log Retention.
Retention schedules dictate how long logs remain accessible in hot, warm, or cold storage.

Key Concept

SIEM Core Log Management Operations
Estimated Time:1m 30s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic