SIEM and Log Analysis
The SIEM and Log Analysis domain tests your ability to turn raw telemetry into defensible conclusions: parsing and normalizing logs, writing searches that answer a question, correlating events across sources, and triaging alerts without drowning in false positives.
Core rules
- Know your sources and fields: Windows Security and Sysmon channels, Linux auditd/syslog, firewall and proxy logs, EDR telemetry, cloud audit logs. Normalization maps them to a common schema such as ECS or CEF.
- Understand the pipeline: collection agent, parser, index, search-time field extraction. A field that is not extracted cannot be correlated reliably.
- Baseline before alerting. A rule that fires on every 4625 is noise; a rule that fires on 20 failures followed by a success is signal.
- Preserve time. Store UTC, normalize timezones at ingest, and note clock skew.
Worked example
You see Windows Event ID 4625 (failed logon) repeated 40 times for one account, then a 4624 success with Logon Type 3 from the same source IP. In Splunk SPL you would group by account and source, then sort by _time. Reasoning: the sequence indicates password guessing followed by network logon; the Logon Type separates interactive from network access, and the source IP scopes the attacker. Check the 4625 failure reason (bad password versus disabled account) and whether the account is privileged.
Traps
- Comparing timestamps from different timezones.
- Counting 4624 events without checking Logon Type (2 interactive, 3 network, 10 RDP).
- Ignoring 1102 (audit log cleared) and gaps in 4688 process creation.
- Tuning alerts by deleting them rather than adding context.
- Assuming a field is populated because the vendor sends it.