Examkin

Soru

Zorluk: KolayLog Analysis and SIEM Management

A security analyst is configuring a new Security Information and Event Management (SIEM) solution. Place the core stages of the SIEM log processing pipeline in the correct sequential order from initial log entry to analyst notification.

  1. 1Log Collection
  2. 2Parsing
  3. 3Normalization
  4. 4Correlation
  5. 5Alerting

Cevap

The correct sequence of stages in a SIEM log processing pipeline is: Log Collection, Parsing, Normalization, Correlation, and Alerting.
In a standard SIEM processing pipeline, raw log data is gathered via Log Collection, extracted into data fields via Parsing, converted to a unified taxonomy during Normalization, cross-analyzed against rules during Correlation, and dispatched to analysts during Alerting.

Adım Adım Çözüm

1
Identify the initial log ingestion activity.
Log Collection occurs first as raw data must be received from source devices before processing.
Data cannot be parsed or analyzed until it is ingested by the SIEM collector.
2
Extract raw fields from collected logs.
Parsing splits unstructured log strings into discrete key-value pairs.
Specific attributes must be recognized within raw log strings before standardizing formats.
3
Standardize variable names and field formats.
Normalization converts heterogeneous fields into a unified system schema.
Standardized data structures allow consistent cross-source log analysis.
4
Evaluate normalized data against rule engines.
Correlation cross-references standardized events across different logs to identify indicators of compromise.
Pattern identification requires normalized inputs from multiple security sources.
5
Dispatch notification of identified incidents.
Alerting informs analysts or triggers security orchestration when correlation logic fires.
Alerting is the final outcome of pipeline processing intended to initiate human or automated incident response.

Anahtar Kavram

SIEM Log Processing Pipeline
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru