SIEM and Log/Data Management
SIEM and log/data management
This domain tests whether you understand the data pipeline behind every detection: collection, parsing, normalization, enrichment, storage, search, correlation, and retention. In Exabeam, detections and investigations are only as good as the logs feeding the platform and the fields used to join them.
Core rules and concepts
- Collection must be complete and timely. Missing logs create blind spots; delayed logs break correlation and timelines.
- Parsing extracts fields from raw events. Normalization maps vendor-specific fields into a common schema so searches and rules work across sources.
- Enrichment adds context such as asset criticality, identity attributes, geoIP, threat intelligence, and peer group. Enrichment failures can make a benign event look anomalous or hide a real one.
- Time matters. Confirm timezone handling, NTP synchronization, and event-time versus ingest-time behavior before trusting a timeline.
- Retention and search are design choices. Hot storage supports fast investigation; long-term data lake storage supports hunting and compliance. Know which data is searchable and for how long.
- Correlation rules depend on normalized fields and reliable joins. A rule that works in one environment may fail after a parser change or log-source rename.
Worked example
An analyst cannot find authentication events for one domain controller in Exabeam, though other domain controllers report normally. Reasoning: check the connector or forwarder status first, then the raw event flow, then the parser. If raw events arrive but normalized user and host fields are empty, the parser or schema mapping is likely broken. If no raw events arrive, investigate the collection path, credentials, firewall, and agent service. Also compare timestamps: a timezone mismatch can place events outside the investigation window even when they were ingested. The fix may be a parser update, connector restart, or timezone correction, followed by a backfill or reparse and validation query.
Traps
- Assuming an empty search means no activity rather than missing or unparsed data.
- Ignoring timezone and clock skew when building timelines.
- Adding rules before validating field normalization and enrichment.
- Keeping everything hot without regard to cost, or retaining too little for investigations.
- Forgetting that parser changes can silently break existing correlations.