SOC Operations
Intermediate 18 min read SOC Operations

SIEM Fundamentals

The SIEM as the SOC's nervous system: ingestion, normalization, correlation, and the storage math that decides what you can afford to keep.

SIEMSplunkELKcorrelationingestionnormalizationretention
Prerequisites: What Is a SOC Telemetry and Logging
Introduction

What is this?

A SIEM aggregates logs and events from across the estate, normalizes them, and correlates them into alerts and investigations a human can actually use.

Motivation

Why do you need it?

  • Singular log sources are deaf; the SIEM is where one host's anomaly meets another's context to become a true positive.
  • Every SOC role interviews on SIEM basics — it is the table stakes of monitoring work.
  • The costs (ingestion, storage, retention) shape every detection decision you will ever make.
Think about it

Mental model

Imagine

One security guard per building

Think of

A central watch desk with every camera feed in one room

Each building sees little; the desk sees the pattern the cameras do not share.

Mechanics

How it works

  • Agents/forwarders ship logs from endpoints, network, and cloud to the SIEM's pipeline.
  • Parsing + normalization map each vendor's field names to a common schema so queries are uniform.
  • Correlation engines run rule/statistical checks across the normalized stream and emit alerts.
  • Search and dashboard layers let analysts pivot from alert to raw evidence to related events.

The SIEM pipeline

Ship
Parse
Store
Correlate
Search
Real world

In production

  • A bank correlates 'failed VPN logins from one IP' with 'new MFA device registered' and blocks the pair instantly.
  • An org tunes the SIEM's storage tiers: hot for 7 days, warm for 90, cold archive for compliance years.
  • A small SOC centralizes cloud, EDR, and DNS logs so one query answers 'what did host X do on Tuesday'.
Guidelines

Best practices

  • Ingest with a purpose: every source reviewed for why, not vacuumed in from boredom.
  • Normalize as close to ingestion as possible, so rules are reusable across sources.
  • Plan retention by risk and compliance before the storage bill surprises you.
  • Build the top twenty searches as saved dashboards the team actually uses daily.
Watch out

Common mistakes

  • Ingesting everything 'just in case' until cost forces painful cuts of the sources you actually need.
  • Never normalizing, so every rule has to know a dozen vendor field names.
  • Alerting on raw counts without correlation — 'too many events' is not an incident.
  • Forgetting that a SIEM only sees what ships: an unmetered endpoint is a blind spot, not a savings.
When things break

Debugging tips

  • When a rule fires oddly, search the raw event and compare its fields to the parser's mapping table.
  • Correlate by a stable identifier (user, asset, source IP) rather than a timestamp window and pray.
  • Test a new rule on historical data before shipping it live to the queue.
Security

Security considerations

  • The SIEM itself is a sensitive store: least-privilege analytic roles and PII-aware retention.
  • Your own tests pollute the stream; tag lab traffic so analysts filter it out.
Interviews

Interview checkpoint

Practice

Hands-on lab

Run a Local Log Pipeline with Correlation
50 min · intermediate
In progress
Objectives
  • Stand up a minimal ELK-style stack in docker.
  • Ship a sample login-failure log file.
  • Write a correlation query that flags 5 failures from one user.

Run a Local Log Pipeline with Correlation

50 min · intermediate

0/4 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/2
1

The correlation engine's value is...

2

Normalization maps...

Go deeper

Official documentation

MITRE ATT&CK / SIEM detection
docs
Elastic SIEM docs
docs