Group 07: SIEM and Log Analysis

What is a SIEM?

A platform that collects, normalizes, searches, correlates, and analyzes security logs from multiple sources.

What is a log source?

A system or application that generates records of activity, such as a firewall, endpoint, identity provider, or cloud platform.

What is log ingestion?

The process of collecting and importing log data into a security platform.

What is log parsing?

Extracting structured fields and values from raw log data.

What is log normalization?

Converting data from different products into a consistent format or schema.

What is a correlation rule?

Detection logic that connects multiple events or conditions to identify suspicious activity.

What is a baseline?

A representation of expected behavior used to identify unusual activity.

What is an anomaly?

Activity that differs from expected behavior but is not automatically malicious.

What is UEBA?

User and Entity Behavior Analytics identifies unusual activity involving users, devices, and other entities.

What is detection engineering?

Designing, testing, tuning, documenting, and maintaining security detections.

What makes a good SIEM detection?

It detects meaningful behavior, uses reliable data, provides useful context, limits noise, and gives analysts a clear investigation path.

How should a noisy detection be tuned?

Review the triggering activity, identify legitimate patterns, adjust thresholds or logic, add narrowly scoped exclusions, test historical data, and monitor the results.

Why should broad exclusions be avoided?

They can suppress real malicious activity and create large visibility gaps.

What is threat hunting?

Proactively searching for suspicious activity that may not have generated an alert.

What is log retention?

The amount of time logs remain stored and available for investigation.

Why is time synchronization important?

Accurate and consistent timestamps allow analysts to correlate events and build reliable timelines.

What is data enrichment?

Adding context such as user information, asset criticality, geolocation, vulnerabilities, or threat intelligence.

What is an indicator of compromise?

Evidence suggesting compromise, such as a malicious hash, IP address, domain, URL, or file.

What is an indicator of attack?

Behavior suggesting an attack is occurring, such as credential dumping, process injection, or suspicious command execution.

What is the difference between an IOC and an IOA?

An IOC is evidence associated with compromise, while an IOA describes suspicious attacker behavior.

Why should threat-intelligence matches be validated?

Indicators may be outdated, shared, misclassified, or associated with legitimate security tools and infrastructure.

What does it mean to pivot from a log event?

Use a field such as a user, host, process, IP address, domain, or hash to search for connected activit