Question

Difficulty: EasyLog Analysis and SIEM Management

A security analyst is configuring a new Security Information and Event Management (SIEM) system. Match each SIEM log processing function on the left to its correct operation on the right.

  • Log ParsingExtracting structured key-value pairs (such as source IP addresses, usernames, and timestamps) from unformatted raw log text strings.
  • Log NormalizationMapping disparate log attributes from different vendors into a standardized naming scheme and schema.
  • Event CorrelationAnalyzing relationships across disparate log sources to detect complex threat patterns and security incidents.
  • Log AggregationConsolidating multiple redundant or identical log entries into a single record to reduce storage and processing overhead.

Answer

Log Parsing matches with extracting structured key-value pairs from raw log text. Log Normalization matches with mapping disparate log attributes into a standardized schema. Event Correlation matches with analyzing relationships across disparate log sources to detect threat patterns. Log Aggregation matches with consolidating redundant log entries to reduce storage overhead.
Each SIEM pipeline stage addresses a specific data processing requirement: Parsing converts raw unformatted text into structured fields; Normalization aligns varying field formats into a common vendor-agnostic taxonomy; Correlation connects events across different systems to identify multi-stage attacks; and Aggregation deduplicates identical events to reduce storage footprint.

Step-by-Step Solution

1
Identify the primary purpose of log parsing.
Parsing breaks raw unstructured text log entries into identifiable, structured attributes.
SIEM systems must parse raw logs before fields can be searched or processed.
2
Identify the primary purpose of log normalization.
Normalization enforces a consistent naming standard across diverse log sources.
Different vendors use different log column names, requiring schema standardization.
3
Identify the primary purpose of event correlation.
Correlation cross-references logs from multiple devices to uncover security incidents.
Complex attacks span multiple systems and require rules to connect separate events.
4
Identify the primary purpose of log aggregation.
Aggregation combines duplicate log records to optimize data storage and ingest performance.
High-volume repetitive logs generate unnecessary overhead if not merged.

Key Concept

SIEM Log Ingestion and Processing Pipeline Stages
Rate this question