A security technician is setting up a Security Information and Event Management (SIEM) log processing pipeline. Match each SIEM log management phase to its corresponding core function.
- ParsingExtracting key data fields (such as IP addresses, usernames, and timestamps) from unstructured log text.
- NormalizationMapping disparate log attributes into a single standardized schema and naming convention.
- CorrelationLinking related log events across multiple security sources using automated rules to detect attack patterns.
- AggregationCombining repetitive, identical event records into a single entry to reduce storage requirements and log volume.
Cevap
Parsing matches extracting key data fields; Normalization matches mapping attributes into a single standardized schema; Correlation matches linking related log events across sources; Aggregation matches combining repetitive identical event records.
Each SIEM log processing stage performs a distinct function: Parsing extracts structured data fields from raw logs; Normalization maps extracted data to a standardized schema; Correlation connects multiple event streams using logic rules to detect security incidents; and Aggregation deduplicates log volume.
Adım Adım Çözüm
Anahtar Kavram
SIEM Log Processing Pipeline