31. SOC, SIEM and Incident Response
31.3 What a SIEM Does
Reading logs server by server does not scale. A SIEM (Security Information and Event Management) system:
- Collects logs from all servers, firewalls, cloud and applications into one place.
- Normalises them into a common format (time, source IP, user, action).
- Correlates events with rules, for example "10 failed logins then 1 success from the same IP within 5 minutes".
- Alerts analysts and shows dashboards.
- Stores logs for investigation and compliance.
Popular options:
| Tool | Type | Notes |
|---|---|---|
| Splunk | Commercial (free trial / limited free version) | Very common in large companies; search language SPL |
| Microsoft Sentinel | Cloud SIEM (Azure) | Common where companies use Microsoft 365/Azure |
| ELK / Elastic Stack | Open source core (Elasticsearch, Logstash/Beats, Kibana) | Flexible; Elastic Security adds detection rules |
| Wazuh | Free and open source | SIEM plus host agent: log analysis, file integrity, vulnerability detection; great for labs |
| QRadar, ArcSight | Commercial | Seen in banks and older enterprises |
A sample Splunk search (SPL) that an analyst might run:
index=linux sourcetype=linux_secure "Failed password"
| stats count by src_ip
| where count > 20
| sort - count
Related tools you will meet: EDR (Endpoint Detection and Response, for example CrowdStrike, Microsoft Defender for Endpoint) watches processes on each machine; SOAR automates response steps (block IP, disable user) from playbooks; IDS/IPS such as Snort and Suricata (Chapter 32) watch network traffic.
Ravindra Bagale's Tip
If an interviewer asks "Do you know Splunk?" and you have never used Splunk, don't panic. The concept of a SIEM (collect, correlate, alert) is the same. If you did Wazuh in the lab and can explain it, interviewers like that even more. Talk about what you have actually done.
Ravindra Bagale's Tip – मराठी
Interview मध्ये "Splunk येतो का?" विचारले आणि तुम्ही Splunk कधी वापरला नसेल तरी घाबरू नका. SIEM ची concept (collect, correlate, alert) सारखीच आहे. Wazuh lab मध्ये केले आणि ते समजावून सांगितले तर interviewer ला ते जास्त आवडते. खरंच जे केले ते सांगा.
Ravindra Bagale's Tip – हिंदी
Interview में "Splunk आता है?" पूछा और आपने Splunk कभी इस्तेमाल नहीं किया तो भी घबराओ मत. SIEM का concept (collect, correlate, alert) एक जैसा है. Wazuh lab में किया और उसे समझा दिया तो interviewer को वह ज़्यादा पसंद आता है. जो सच में किया वही बताओ.
Practice task
Write a correlation rule in plain English for each: (1) SSH brute force followed by success, (2) a new IAM user created at 2 a.m. in AWS, (3) one IP requesting more than 200 different URLs in one minute. Name the log source each rule needs.