SIEM engineering: data model, correlation, capacity
You don’t just use a SIEM, you design it: deciding what data to collect, how to normalise it, and how to manage correlation rules and capacity.
Level 401 · 13 lessons · 15 practice labs
Lessons
Data strategy
- Collecting logs driven by use cases
- The process for onboarding a new log source
- Parsing quality: catching missing fields and broken timestamps
- Log source health: noticing sources that go quiet
- Short task: onboard a firewall and set up a silence alert
Correlation
- Designing correlation rules: one alert from several sources
- Risk-based alerting: accumulating scores
- Enrichment lookups: assets, users, criticality
- Short task: combine a VPN login and the unusual access that follows into one alert
Capacity and operations
- Capacity planning: daily volume, retention, cost
- Hot, warm and cold tiers
- SIEM access control and audit trail
- Capstone: a SIEM design document and proof environment for a mid-sized organisation
Practice labs
- Onboard a firewall log and validate its fields: Connect the source and prove with sample events that source, destination, port and action parse correctly.
- Measure the share of events with parsing errors: Count events tagged with parse failures, find the most common broken format and fix the parser.
- Set up an alert for a source that goes quiet: Determine the expected event rate per source and test a rule that alerts when one is silent for fifteen minutes.
- Derive the required log fields from a use case: Write down which sources and fields a data exfiltration use case needs and show what is missing in the current data.
- Join a VPN login with the unusual access that follows: Write a rule linking two sources by user and show both events in a single alert.
- Build an alert that accumulates risk scores: Give low-level events scores, sum them per user and raise one alert when the threshold is crossed.
- Enrich an alert with asset criticality: Load the asset table as a lookup, add owner and criticality to alerts and adjust severity accordingly.
- Normalise a user field written differently in two sources: Remove the field-name and format difference and return both sources’ events for the same user in one query.
- Calculate storage from daily log volume: Sum daily size per source and calculate the storage needed for 90 days of retention.
- Find and filter the useless event that takes the most space: Rank volume by event type, filter the noisy type no detection uses at the source and measure the saving.
- Find who deleted what in the SIEM from the audit trail: Find the account and time a detection rule was disabled from audit records and narrow the role’s rights.
- Fill in the intake form for a new log source: Fill in an intake form for a proxy log with owner, format, daily volume, retention and expected fields by looking at sample records.
- Find the source that arrives with the wrong time zone: Compare the gap between event time and ingest time for three sources and identify the one arriving three hours off.
- Decide which context an alert is missing: Mark for three alerts which of owner, criticality and location fields are empty.
- Load the asset list into the SIEM as a lookup table: Turn a file with host, owner and criticality columns into a lookup and join it to records in a query.
About this course
You don’t just use a SIEM, you design it: deciding what data to collect, how to normalise it, and how to manage correlation rules and capacity.
What you will learn
- Data strategy
- Correlation
- Capacity and operations
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.