Introduction to SIEM

A Security Information and Event Management (SIEM) system is like the central nervous system of a Security Operations Center (SOC). It collects, aggregates, and analyzes log data from across an organization's IT infrastructure.

Why Do We Need SIEM?

Imagine a network with hundreds of servers, thousands of endpoints, firewalls, routers, and applications. Each of these devices generates logs detailing its activity. Reviewing these logs manually to spot an attack is like finding a needle in a haystack—while blindfolded.

A SIEM solves this by:

1. Centralized Logging: Pulling all logs into one place.
2. Correlation: Connecting the dots. For example, if a user fails to log in 50 times from a foreign IP address, and then successfully logs in, the SIEM flags it.
3. Alerting: Notifying analysts when something suspicious happens.

Popular SIEM Solutions

• Splunk
• IBM QRadar
• ELK Stack (Elasticsearch, Logstash, Kibana) - Open Source
• Microsoft Sentinel

Example: A Simple Correlation Rule

Let's say we want to detect a brute-force attack. We might write a rule like this:

SELECT user_id, source_ip
FROM authentication_logs
WHERE status = 'failed'
GROUP BY user_id, source_ip
HAVING COUNT(*) > 10 IN 5 MINUTES

When this rule triggers, an analyst investigates the alert to determine if it's a real attack or just a user who forgot their password.