SIEM Fundamentals

Overview

A SIEM collects, stores, searches, correlates, and analyzes security logs from across an entire environment — the primary tool SOC analysts work from day to day.

Key concepts

Log ingestion, normalization, parsing
Correlation, detection rules, queries
Common log sources: Windows, Linux, firewall, DNS, cloud, identity

How it works

A SIEM (Security Information and Event Management system) collects, stores, searches, correlates, and analyzes security logs from multiple sources.

Core SIEM terms

Term	Meaning
Log	A recorded event generated by a device, system, application, or security tool.
Log source	A device, service, application, or platform that sends logs to a SIEM.
Log ingestion	The process of collecting and sending logs into a SIEM.
Log retention	How long logs are stored before being deleted or archived.
Normalization	Converting logs from different sources into a consistent format so they can be searched together.
Parsing	Extracting useful fields — usernames, IPs, timestamps, event IDs, filenames — from raw log data.
Correlation	Combining related events from multiple sources to identify suspicious patterns.
Detection rule	A logical condition that generates an alert when specific suspicious behavior occurs.
Query	A request used to search, filter, or analyze log data — the same concept used to pull data from any database.
Data source coverage	The amount and quality of security visibility provided by the logs feeding a SIEM.

Common SIEM log sources

Source	What it captures
Windows Event Logs	Authentication events, process creation, account changes, security-policy changes.
Linux logs	Authentication activity, system events, service activity, command execution.
Firewall logs	Network traffic allowed, blocked, or inspected.
DNS logs	Domain-name requests made by devices and users.
Proxy logs	Web requests passing through a proxy or secure web gateway.
VPN logs	Remote-access connections, authentication attempts, device info, session activity.
EDR logs	Endpoint telemetry — processes, command lines, file changes, network connections, alerts.
Email security logs	Phishing attempts, malicious attachments, blocked messages, spam, delivery activity.
Cloud logs	Account logins, administrative actions, file access, configuration changes, API activity.
Identity-provider logs	Authentication and account-management records from Active Directory, Entra ID, or SSO platforms.