1
● Module 04
● Report: Incident Detection with SIEM
● Created By: Muniba khan
● 📘 Incident Detection with SIEM – Full Report
Incident Detection with SIEM – Full Report
1. Security Information and Event Management (SIEM)
Definition:
SIEM is a centralized solution that collects, aggregates, analyzes, and correlates security data
from multiple systems to detect threats and enable incident response.
Working Concept:
It integrates with devices like firewalls, servers, endpoints, and applications to gather logs, apply
analytics, and trigger alerts for unusual behavior.
Example:
A SIEM detects multiple failed logins followed by a successful login from an unknown location
– triggering a possible brute-force attack alert.
2
2. Security Analytics
Definition:
Analyzing security-related data using rules, machine learning, and behavioral analysis to
identify risks and attacks.
Working Concept:
Security analytics in SIEM looks for anomalies and threat patterns in logs.
Example:
Detection of a user accessing sensitive data outside business hours using behavior baselines.
3
3. Need of SIEM
Definition:
SIEM is essential to monitor vast volumes of logs, detect threats in real time, and comply with
regulations.
Working Concept:
It automates monitoring and enhances visibility across IT environments.
Example:
A business uses SIEM to meet PCI-DSS compliance by logging and tracking credit card data
access.
4
4. Log Collection
Definition:
Gathering logs from different sources like firewalls, servers, databases, and applications.
Working Concept:
SIEM uses agents or APIs to collect logs in real-time or batch mode.
Example:
Logs from Windows Event Viewer and Apache web server are collected into the SIEM console.
5
6
5. Log Analysis
Definition:
Interpreting collected logs to identify security incidents, trends, and system behavior.
Working Concept:
The SIEM parses, normalizes, and filters log data for analysis.
Example:
A spike in 404 errors from a single IP is flagged as a potential web vulnerability scan.
6. Event Correlation
Definition:
Connecting multiple events across systems to identify security incidents.
Working Concept:
SIEM correlates logs using rules, such as combining login attempts with unusual IP access.
Example:
Failed login + privilege escalation + new user account = Possible insider threat.
7
7. Log Forensics
Definition:
The process of investigating historical logs for incident root cause analysis.
Working Concept:
SIEM stores and allows querying of historical logs for timeline reconstruction.
Example:
Reviewing logs to trace how ransomware entered the network via an email attachment.
8. IT Compliance
Definition:
Meeting legal and industry security requirements (e.g., HIPAA, PCI-DSS, ISO 27001).
Working Concept:
SIEM provides audit trails, access logs, and policy enforcement support.
Example:
Using SIEM-generated reports during an ISO 27001 audit to prove access control compliance.
8
9. Application Log Monitoring
Definition:
Monitoring logs from software applications for performance or security issues.
Working Concept:
SIEM ingests logs from ERP, CRM, or in-house tools and checks for anomalies.
Example:
An e-commerce application shows repeated checkout failures, indicating a possible code
injection attack.
10. Object Access Auditing
Definition:
Tracking who accessed or attempted to access specific files, folders, or objects.
Working Concept:
File systems and applications send access logs to the SIEM for audit tracking.
Example:
SIEM flags an unauthorized user accessing HR salary spreadsheets.
9
11. Real-Time Alerting
Definition:
Instant notification to security teams when suspicious activity is detected.
Working Concept:
Rules or AI trigger alerts in real time based on predefined thresholds or behaviors.
Example:
SIEM alerts on a high number of failed SSH login attempts from a foreign IP.
12. User Activity Monitoring
Definition:
Tracking user actions across systems for security or compliance.
Working Concept:
SIEM captures user login, logout, file access, and privilege changes.
Example:
Admin accesses production database after hours – alert sent to SOC.
10
13. Dashboards
Definition:
Visual representation of system health, security status, and threat data.
Working Concept:
SIEM presents charts, graphs, and KPIs in real time for easy monitoring.
Example:
SOC dashboard shows a spike in malware alerts in the last 24 hours.
14. Reporting
Definition:
Generating scheduled or on-demand reports for audits, performance, or incident tracking.
Working Concept:
SIEM offers customizable and automated reports.
Example:
Weekly executive summary of critical alerts and resolved incidents.
11
15. File Integrity Monitoring (FIM)
Definition:
Monitoring files for unauthorized changes or deletions.
Working Concept:
SIEM compares file states over time and logs differences.
Example:
SIEM detects a change in /etc/passwd file on a Linux server – potential rootkit.
16. System and Device Log Monitoring
Definition:
Monitoring logs from routers, switches, servers, and endpoints.
Working Concept:
All system logs are centralized and analyzed for device-specific anomalies.
Example:
Firewall logs show repeated port scans from the same IP – SIEM alerts the SOC.
12
🗄️ 17. Log Retention
Definition:
Storing logs for long-term access to support audits, investigations, and compliance.
Working Concept:
SIEM enforces retention policies to store logs for months or years.
Example:
Access logs from 9 months ago retrieved to support a legal investigation.
Conclusion
SIEM systems play a crucial role in modern cybersecurity by providing comprehensive
monitoring, detection, and response capabilities. Understanding the architecture and components
of SIEM systems is essential for effectively leveraging their potential to safeguard organizational
assets.