Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security engineer is configuring an enterprise Security Information and Event Management (SIEM) pipeline to process raw web application traffic logs and detect potential SQL injection attacks. Arrange the following log processing and analysis stages in the correct sequential order from initial log generation to SOC notification.

  1. 1The web server generates an unformatted, raw HTTP access log entry containing query parameters and client IP details.
  2. 2The SIEM ingestion agent parses the raw log stream, using regular expressions to extract key-value fields such as source IP, request string, and HTTP status code.
  3. 3The SIEM normalizes extracted field names to align with the enterprise Common Information Model schema across all log sources.
  4. 4Contextual telemetry enrichment attaches threat intelligence metadata, such as external IP reputation scores and geolocation, to the event.
  5. 5The correlation engine evaluates event metrics across a rolling time window against established threshold patterns for database syntax anomalies.
  6. 6The SIEM generates a high-severity alert in the Security Operations Center (SOC) dashboard and triggers an automated notification workflow.

Answer

The correct operational sequence is: (1) Raw web server log generation, (2) Field parsing via regular expressions, (3) Data normalization into a common schema, (4) Contextual telemetry enrichment, (5) Correlation rule evaluation across time windows, and (6) SIEM alert generation and SOC escalation.
The SIEM pipeline strictly processes events in sequential stages: raw log creation at the host is followed by parsing string text into discrete key-value fields. Once parsed, fields are normalized to a common enterprise schema so correlation logic remains vendor-agnostic. Enriched telemetry (such as threat intelligence reputational scores) is added next. The correlation engine then compares the normalized, enriched events against time-window thresholds. Finally, matching correlation conditions trigger an automated alert and escalation in the SOC dashboard.

Step-by-Step Solution

1
Identify the event origination point.
The web server creates raw log text locally upon receiving an HTTP request.
Log data must first exist at the source endpoint before it can be collected and processed by SIEM infrastructure.
2
Structure the raw data payload.
SIEM ingestion regex splits string data into discrete key-value pairs.
Unstructured text cannot be efficiently queried or correlated until field boundaries are extracted.
3
Standardize variable names.
Parsed fields map to standard enterprise schema tags.
Normalization ensures correlation logic written for one device type applies across all vendor formats.
4
Augment event data with security context.
Event record receives threat intelligence risk scores and geographic metadata.
Enrichment allows correlation engines to weigh contextual risk (e.g., suspicious IP reputation) during rule evaluation.
5
Analyze multi-event patterns.
Stateful correlation engine detects threshold breaches for malicious patterns within a specified timeframe.
Correlation links individual enriched events together to detect broader attack behaviors.
6
Trigger security response.
An actionable alert is pushed to the SOC queue.
Alert generation notifies analysts after correlation logic confirms a high-confidence security event.

Key Concept

SIEM Log Processing Pipeline Lifecycle
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic