31. SOC, SIEM and Incident Response
31.3 What a SIEM Does
Reading logs server by server does not scale. A SIEM (Security Information and Event Management) system:
- Collects logs from all servers, firewalls, cloud and applications into one place.
- Normalises them into a common format (time, source IP, user, action).
- Correlates events with rules, for example "10 failed logins then 1 success from the same IP within 5 minutes".
- Alerts analysts and shows dashboards.
- Stores logs for investigation and compliance.
Popular options:
| Tool | Type | Notes |
|---|---|---|
| Splunk | Commercial (free trial / limited free version) | Very common in large companies; search language SPL |
| Microsoft Sentinel | Cloud SIEM (Azure) | Common where companies use Microsoft 365/Azure |
| ELK / Elastic Stack | Open source core (Elasticsearch, Logstash/Beats, Kibana) | Flexible; Elastic Security adds detection rules |
| Wazuh | Free and open source | SIEM plus host agent: log analysis, file integrity, vulnerability detection; great for labs |
| QRadar, ArcSight | Commercial | Seen in banks and older enterprises |
A sample Splunk search (SPL) that an analyst might run:
index=linux sourcetype=linux_secure "Failed password"
| stats count by src_ip
| where count > 20
| sort - count
Related tools you will meet: EDR (Endpoint Detection and Response, for example CrowdStrike, Microsoft Defender for Endpoint) watches processes on each machine; SOAR automates response steps (block IP, disable user) from playbooks; IDS/IPS such as Snort and Suricata (Chapter 32) watch network traffic.
Ravindra Bagale's Tip
Interview madhe "Splunk yeto ka?" vicharla ani tumhi Splunk kadhi vaparla nahi tari ghabru naka. SIEM chi concept (collect, correlate, alert) sarkhich aahe. Wazuh lab madhe kela ani te samjavun sangitla tar interviewer la te jast avadte. Kharach je kela te sanga.
Practice task
Write a correlation rule in plain English for each: (1) SSH brute force followed by success, (2) a new IAM user created at 2 a.m. in AWS, (3) one IP requesting more than 200 different URLs in one minute. Name the log source each rule needs.