Examkin

Soru

Zorluk: OrtaLog Analysis and SIEM Management

A security engineer is designing an enterprise Security Information and Event Management (SIEM) log pipeline to ingest data from heterogeneous sources. Place the stages of the log processing life cycle in the correct chronological order from initial log intake to incident detection notification.

  1. 1Log Collection & Ingestion
  2. 2Parsing & Normalization
  3. 3Aggregation & Indexing
  4. 4Correlation Engine Processing
  5. 5Alerting & Escalation

Cevap

The correct sequential order of log processing within a SIEM pipeline is: Log Collection & Ingestion, Parsing & Normalization, Aggregation & Indexing, Correlation Engine Processing, and Alerting & Escalation.
In a modern SIEM architecture, log data must flow logically from capture (ingestion) to field mapping (normalization), centralized storage indexing (aggregation), threat pattern evaluation (correlation), and finally analyst notification (alerting).

Adım Adım Çözüm

1
Gather raw telemetry from sources
Raw logs are retrieved via agents, Syslog streams, or cloud API integrations (Log Collection & Ingestion).
Log data must first enter the SIEM platform before any transformation or analysis can occur.
2
Standardize heterogeneous log formats
Raw syslog, JSON, and XML entries are translated into standardized fields such as source IP, destination port, and user ID (Parsing & Normalization).
Disparate logs must share a common schema so cross-platform rules can interpret them uniformly.
3
Store and structure data for searching
Normalized events are indexed into high-performance search databases and datastores (Aggregation & Indexing).
Indexing ensures efficiently structured data availability for rule engines and historical SOC investigations.
4
Evaluate data against detection logic
The correlation engine analyzes normalized, indexed log streams against behavioral patterns and complex conditional rules (Correlation Engine Processing).
Detection engines depend on multi-source normalized events to identify cross-system indicators of compromise.
5
Dispatch actionable security notifications
Matches exceeding risk thresholds generate SOC notifications, tickets, or automated SOAR triggers (Alerting & Escalation).
Notifications take place only after rule logic confirms a security event.

Anahtar Kavram

SIEM Log Processing Pipeline
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru