Soru

Zorluk: KolayLog Analysis and SIEM Management

An organization deploys a centralized Security Information and Event Management (SIEM) platform to monitor enterprise infrastructure. In what sequence does a security log event travel through the SIEM pipeline from initial creation to analyst notification?

  1. 1Event Generation: An operating system or service writes an activity record to its local system log.
  2. 2Log Forwarding: A collector agent or Syslog service securely transmits the log entry over the network to the SIEM instance.
  3. 3Parsing and Normalization: The SIEM extracts unstructured fields into standardized key-value pairs (such as IP addresses and timestamps).
  4. 4Event Correlation: The SIEM engine evaluates normalized data streams against defined detection rules and threat patterns.
  5. 5Alert Generation: The SIEM triggers a security incident notification for SOC analyst investigation.

Cevap

The correct order of log processing within a SIEM pipeline is: Event Generation -> Log Forwarding -> Parsing and Normalization -> Event Correlation -> Alert Generation.
Log processing follows a logical pipeline: an event must first be generated locally on an endpoint, forwarded to central storage, parsed into standard fields so multi-source data is consistent, evaluated by correlation engines against threat rules, and finally escalated as an alert when suspicious activity is detected.

Adım Adım Çözüm

1
Identify the initial event creation step
The local system logs the event.
Data processing starts when an application or host creates a log entry locally.
2
Identify the transmission step
Log agents forward the entry to the SIEM.
Centralized SIEM analysis requires log entries to be transmitted over the network.
3
Identify the data structuring step
The SIEM parses and normalizes the log data into standardized fields.
Heterogeneous vendor logs must be converted into common schemas before cross-source rule matching.
4
Identify the detection rule evaluation step
The correlation engine checks normalized logs against security rules.
Rule matching identifies indicators of compromise across correlated data streams.
5
Identify the final output step
The SIEM generates a security alert.
Notifications are created after correlation conditions are met to notify security staff.

Anahtar Kavram

SIEM Log Processing Pipeline Lifecycle
Bu soruyu puanla