Security Operations, Monitoring, and SIEM
Domain 6 covers security operations center (SOC) work: log collection, SIEM correlation, alert triage, tuning, and reporting. The exam expects you to distinguish detection from response and to reason about signal quality.
Core rules and concepts
- SIEM ingests logs from firewalls, endpoints, identity providers, cloud services, and applications; normalization and time sync make correlation possible.
- Correlation rules combine events into alerts. A use case states the behavior, data sources, logic, and response.
- Triage validates an alert: scope, severity, false-positive check, and escalation. Tier 1 handles routine alerts; escalation goes to deeper analysis.
- Tuning reduces noise by adjusting thresholds, suppressing known benign activity, and fixing broken parsers.
- Metrics include mean time to detect, mean time to respond, alert volume, and false-positive rate.
- SOAR can automate enrichment and containment, but automation must be narrowly scoped and auditable.
Worked example
SIEM alerts: 20 failed logins followed by a success from a foreign IP for a finance user. Check identity logs for MFA result, VPN logs for impossible travel, and EDR for new processes. If MFA was bypassed and a new admin account appeared, escalate to incident response and isolate the session. Reasoning: correlation across sources separates a mistyped password from credential compromise.
Traps that cost marks
A SIEM does not fix incidents by itself. More logs do not automatically improve detection; unparsed logs create blind spots. Ignoring time zone and clock drift breaks correlation. Closing alerts without documented validation hides gaps.