A security analyst is configuring a new Security Information and Event Management (SIEM) system. Match each SIEM log processing function on the left to its correct operation on the right.
- Log ParsingExtracting structured key-value pairs (such as source IP addresses, usernames, and timestamps) from unformatted raw log text strings.
- Log NormalizationMapping disparate log attributes from different vendors into a standardized naming scheme and schema.
- Event CorrelationAnalyzing relationships across disparate log sources to detect complex threat patterns and security incidents.
- Log AggregationConsolidating multiple redundant or identical log entries into a single record to reduce storage and processing overhead.
Answer
Log Parsing matches with extracting structured key-value pairs from raw log text. Log Normalization matches with mapping disparate log attributes into a standardized schema. Event Correlation matches with analyzing relationships across disparate log sources to detect threat patterns. Log Aggregation matches with consolidating redundant log entries to reduce storage overhead.
Each SIEM pipeline stage addresses a specific data processing requirement: Parsing converts raw unformatted text into structured fields; Normalization aligns varying field formats into a common vendor-agnostic taxonomy; Correlation connects events across different systems to identify multi-stage attacks; and Aggregation deduplicates identical events to reduce storage footprint.
Step-by-Step Solution
Key Concept
SIEM Log Ingestion and Processing Pipeline Stages