L13. Security Monitoring & SIEM
Course outlineLesson 13 of 20
You cannot defend what you cannot see. SIEM aggregates logs from across the environment to provide the visibility security teams need to detect and respond to threats in time.
Log Sources
Effective security monitoring requires logs from multiple sources:
| Source | What It Captures |
|---|---|
| Firewall / NGFW | Allowed and blocked connections, policy hits |
| Endpoint / EDR | Process creation, file events, registry changes, network connections |
| Authentication (AD/Entra ID) | Logon events, failed attempts, MFA prompts, privilege use |
| DNS | Queries and responses; useful for detecting C2 communication |
| Proxy / web gateway | URLs visited, categories, user-agent strings |
| NetFlow | Network traffic metadata (src/dst IP, port, bytes); no packet content |
SIEM
A SIEM (Security Information and Event Management) aggregates logs from all sources, normalizes them to a common format, and applies correlation rules to generate alerts.
Key SIEM capabilities:
- Log aggregation: collect from firewalls, endpoints, directories, cloud services
- Correlation: combine events across sources to detect multi-step attacks
- Alerting: notify analysts when rule thresholds are crossed
- Dashboards: visualize threat landscape and compliance posture
- Retention: store logs for compliance (PCI: 1 year, HIPAA: 6 years)
Examples: Microsoft Sentinel, Splunk, IBM QRadar, Elastic SIEM.
SOC Tiers
| Tier | Role |
|---|---|
| Tier 1 | Alert triage; first responder; closes false positives; escalates true positives |
| Tier 2 | Incident investigation; determines scope and root cause |
| Tier 3 | Threat hunting; advanced analysis; develops new detection content |
UEBA
UEBA (User and Entity Behavior Analytics) adds machine learning on top of SIEM log data to detect anomalous behavior that rules alone miss: impossible travel, unusual data access patterns, after-hours privilege escalation.
- ✓SIEM aggregates and correlates logs from multiple sources to detect multi-step attacks; UEBA adds ML-driven behavioral analysis
- ✓SOC Tier 1 triages and closes alerts; Tier 2 investigates incidents; Tier 3 hunts for threats proactively
- ✓DNS logs are essential for detecting C2 communication: look for high-volume queries to unusual or newly registered domains
- ✓NetFlow captures network traffic metadata (IP, port, bytes) without packet content; useful for detecting exfiltration volume
- ✓SIEM log retention requirements vary by regulation: PCI-DSS requires 1 year; HIPAA requires up to 6 years
1. A SOC analyst receives a high-priority alert, investigates it, and determines it is a false positive. They close the ticket and document their findings. Which SOC tier is performing this work?
2. Which log source is most useful for detecting Command and Control (C2) communication from an infected endpoint?
3. Which security technology uses machine learning to detect anomalous user behavior such as impossible travel or unusual data access outside normal working hours?
Recommended: Pluralsight
Turn your CompTIA Security+ concepts into passing marks: Pluralsight adds structured study plans, practice exams, and hands-on scenario labs.