Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security engineer is configuring a SIEM collector to process raw syslog feeds from perimeter devices. Place the stages of SIEM log processing in the correct order from initial ingestion to analyst notification.

  1. 1Log Collection & Ingestion: Raw syslog telemetry packets are received over the network from security appliances.
  2. 2Parsing & Field Extraction: Unstructured syslog strings are split into discrete key-value fields such as source IP, destination IP, and event ID.
  3. 3Data Normalization: Extracted vendor-specific attributes are converted into standardized naming formats across all ingested data sources.
  4. 4Event Correlation: Normalized log data is cross-referenced against historical trends, threat intelligence, and detection rule criteria.
  5. 5Alert Generation: Triggered correlation rule outputs spawn security incidents and dispatch notifications to SOC analysts.

Answer

The correct sequence of SIEM log processing stages is Log Collection & Ingestion, Parsing & Field Extraction, Data Normalization, Event Correlation, and Alert Generation.
The SIEM log processing pipeline must proceed sequentially from raw data capture to actionable intelligence. First, Log Collection & Ingestion gathers raw logs from network sources. Second, Parsing & Field Extraction breaks unstructured strings into distinct field variables. Third, Data Normalization maps vendor-specific variables into a unified schema. Fourth, Event Correlation analyzes normalized fields against detection rules and threat feeds. Finally, Alert Generation dispatches notifications to analysts when correlated events breach security thresholds.

Step-by-Step Solution

1
Identify the initial entry point of telemetry into the SIEM pipeline.
Log Collection & Ingestion is placed first because raw logs must be received before any processing can occur.
Raw data must be gathered from source endpoints or network appliances first.
2
Identify how raw unstructured strings are structured.
Parsing & Field Extraction is placed second to break raw text strings into discrete data variables.
Extracting key-value pairs is necessary before data can be categorized or standardized.
3
Identify how disparate vendor fields are unified.
Data Normalization is placed third to map extracted variables to a standard schema.
Standardizing field names allows the SIEM to analyze logs from different manufacturers consistently.
4
Determine how security context is established across normalized telemetry.
Event Correlation is placed fourth to evaluate normalized data against rules and threat intelligence.
Correlation logic requires structured, normalized data to accurately detect multi-source threats.
5
Determine the operational output resulting from correlation matches.
Alert Generation is placed fifth to notify security analysts of actionable security events.
Alert dispatches occur as the end result of matched correlation criteria.

Key Concept

SIEM Log Processing Pipeline
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic