SIEM Basics - Vocabulary Flashcards

Vocabulary flashcards covering key SIEM concepts from the lecture notes.

SIEM

Security Information and Event Management system that aggregates logs from networks and devices to provide real-time or near real-time analysis and detection of anomalies.

Log collection

Process of gathering event records from sources across the network, typically via Syslog, to a centralized data store for analysis.

Syslog

A protocol for sending log messages from devices to a SIEM; commonly uses UDP port 514 and can use TCP depending on configuration.

Normalization

Mapping log messages from different systems into a common data model to enable cross-system analysis.

Correlation

Linking logs and events from multiple systems into a single data feed to improve threat detection and response speed.

Aggregation

Reducing the volume of event data by consolidating duplicate events into a single record.

Reporting

Presenting correlated and aggregated data in real-time dashboards for analysts and in long-term summaries for management.

Five essential SIEM functions

Log collection, normalization, correlation, aggregation, and reporting.

Baseline

The normal operating state; logs and alerts are reviewed to detect anomalies outside the baseline.

Use cases

Defined scenarios that describe what constitutes a threat and what actions to take in response.

Incident response

Preplanned responses for given events or threats to take action quickly.

Threat hunting

Regular proactive searching by analysts to find threats that automated alerts may miss.

Scope

The defined set of events to log and monitor; determines what is included or excluded.

Ticketing process

A process to track flagged events from detection to resolution and closure.

Evidence trail

An auditable trail of events maintained by the SIEM for auditors and investigators during compliance.

Centralized repository

A single, centralized store of logs and events from across the network for analysis.

Real-time analysis

Analysis of security alerts as they occur or nearly so.