A Security Operations Center (SOC) team is organizing its Security Information and Event Management (SIEM) data pipeline. Match each SIEM data processing phase on the left with its primary operational function on the right.
- ParsingExtracting structured key-value pairs from raw, unformatted log strings.
- NormalizationMapping disparate log field names and formats to a common standard schema.
- AggregationConsolidating duplicate log events to decrease storage and bandwidth usage.
- CorrelationAnalyzing relationships among events from diverse sources over time to detect threats.
Cevap
Parsing corresponds to extracting structured key-value pairs from raw log strings. Normalization corresponds to mapping disparate log field names to a common standard schema. Aggregation corresponds to consolidating duplicate log events. Correlation corresponds to analyzing relationships among events across diverse log sources over time.
Each SIEM processing phase has a distinct function: Parsing extracts key-value pairs from raw log text; Normalization maps extracted fields to a common taxonomy; Aggregation deduplicates log events to save storage; and Correlation analyzes logic across multiple sources to identify complex security incidents.
Adım Adım Çözüm
Anahtar Kavram
SIEM Log Ingestion and Processing Pipeline