Log Collection, SIEM Correlation, and Alert Triage
Log Collection, SIEM Correlation, and Alert Triage tests whether you can onboard the right telemetry, normalize it into a common schema, correlate it into something meaningful, and decide within minutes whether an alert is real. Items reward precise knowledge of event semantics over generic SIEM vocabulary.
Collection rules
- Windows: 4624 logon (Type 2 interactive, 3 network, 5 service, 10 RDP), 4625 failure, 4648 explicit credentials, 4672 special privileges assigned, 4688 process creation - which only carries a command line if the command-line audit policy is enabled - 4720 account created, 4768/4769 Kerberos TGT/TGS requests, 4771 pre-authentication failure, 7045 service installed, 1102 audit log cleared, 4104 PowerShell script block.
- Linux: auditd execve records, auth.log or secure, sudo entries, systemd journal, eBPF process sensors.
- Cloud and SaaS: CloudTrail management events, Entra ID sign-in and audit logs, M365 Unified Audit Log, SaaS admin audit trails.
- Transport and time: prefer TCP/TLS syslog over UDP, normalize timestamps to UTC, and monitor NTP drift - a five-minute skew destroys any sequence-based correlation.
Correlation and triage
Rule families are threshold (n events in t), temporal sequence (A then B inside a window), stateful first-seen, and enrichment joins to asset criticality, identity privilege, geoIP and threat intel. Normalizing to ECS or OCSF lets one rule serve multiple sources. Triage severity is the product of alert severity, asset criticality and identity privilege - not the alert label alone. Confirm against raw logs before escalating, and close false positives with a reason code that feeds tuning.
Worked example
A rule fires on five 4625 events followed by a 4624 for the same account within ten minutes. Reasoning: the failures alone could be a stale cached credential, but the success converts the pattern into either password guessing that worked or a legitimate user who fat-fingered the password repeatedly. Check source IP against the user's normal geography, check whether the logon type is 3 or 10, check whether 4672 followed, and check whether the account is privileged. Only that combination justifies escalation.
Traps that cost marks
Treating a missing log as proof of no activity - ingestion lag, dead forwarders and disabled audit policy are routine. Confusing 4624 Type 3 with interactive logon. Writing rules against hostnames that change on rebuild. Forgetting that EPS licensing can silently drop the highest-volume sources, typically DNS and firewall.