Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

An enterprise Security Information and Event Management (SIEM) pipeline is being configured to ingest, analyze, and respond to authentication anomalies across a hybrid environment. Place the following stages of the SIEM log processing pipeline in the correct sequential order from initial endpoint activity to final incident response.

  1. 1Telemetry Collection: Raw syslog and Windows Event Logs (e.g., Event ID 4624) are generated by source hosts and forwarded to the SIEM log collector.
  2. 2Parsing and Extraction: Key-value pairs such as source IP addresses, account names, and status codes are extracted from unstructured log strings.
  3. 3Data Normalization: Extracted field labels are mapped to a standardized schema taxonomy (e.g., Open Cybersecurity Schema Framework) across disparate vendor logs.
  4. 4Event Correlation: The SIEM engine evaluates normalized events against temporal threshold rules and detection logic to identify complex attack patterns.
  5. 5Alerting and Orchestration: An automated security incident ticket is opened, and a SOAR workflow is executed to isolate affected hosts.

Answer

The correct sequential order of stages in a SIEM log processing pipeline is: (1) Telemetry Collection, (2) Parsing and Extraction, (3) Data Normalization, (4) Event Correlation, and (5) Alerting and Orchestration.
The correct sequence mirrors the standard data lifecycle within a SIEM pipeline: Telemetry Collection gathers raw logs; Parsing extracts specific variables from text; Normalization standardizes field names across multi-vendor log sources; Correlation applies stateful detection logic across normalized events; and Alerting/Orchestration triggers notifications and automated response playbooks.

Step-by-Step Solution

1
Identify the entry point of event data into the log management pipeline.
Telemetry Collection is established as the initial stage where raw events are emitted and received.
Data must be gathered from endpoints, firewalls, and application servers before any processing can begin.
2
Determine how unstructured log payloads are converted into usable data fields.
Parsing and Extraction follows Collection.
Raw string messages (e.g., Syslog headers or Windows XML) must be broken down into discrete attributes such as IP addresses and event IDs.
3
Standardize variable attributes across multiple vendor platforms.
Data Normalization occurs after Parsing.
Mapping diverse vendor keys (e.g., 'src_ip' vs 'SourceAddress') to a unified schema is required so correlation rules can evaluate events uniformly.
4
Analyze structured, uniform data against security rule logic.
Event Correlation takes place post-normalization.
Correlation engines compare normalized telemetry against detection rules across time windows to detect multi-stage attacks.
5
Identify the response and notification phase resulting from correlation matches.
Alerting and Orchestration is the final stage.
Notifications, ticketing, and automated mitigation actions via SOAR occur only after rule logic identifies a verified threat condition.

Key Concept

SIEM Log Processing Pipeline
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic