An organization deploys a centralized Security Information and Event Management (SIEM) platform to monitor enterprise infrastructure. In what sequence does a security log event travel through the SIEM pipeline from initial creation to analyst notification?
- 1Event Generation: An operating system or service writes an activity record to its local system log.
- 2Log Forwarding: A collector agent or Syslog service securely transmits the log entry over the network to the SIEM instance.
- 3Parsing and Normalization: The SIEM extracts unstructured fields into standardized key-value pairs (such as IP addresses and timestamps).
- 4Event Correlation: The SIEM engine evaluates normalized data streams against defined detection rules and threat patterns.
- 5Alert Generation: The SIEM triggers a security incident notification for SOC analyst investigation.
Cevap
The correct order of log processing within a SIEM pipeline is: Event Generation -> Log Forwarding -> Parsing and Normalization -> Event Correlation -> Alert Generation.
Log processing follows a logical pipeline: an event must first be generated locally on an endpoint, forwarded to central storage, parsed into standard fields so multi-source data is consistent, evaluated by correlation engines against threat rules, and finally escalated as an alert when suspicious activity is detected.
Adım Adım Çözüm
Anahtar Kavram
SIEM Log Processing Pipeline Lifecycle