SIEM aggregates logs from the entire infrastructure, correlates events, and detects security incidents.
How SIEM works¶
- Log collection from all sources
- Normalization and parsing
- Event correlation
- Anomaly and rule detection
- Alerting and response
Open-source SIEM¶
- Wazuh: HIDS + SIEM, agent-based
- Elastic SIEM: Elasticsearch + Kibana + detection rules
- Grafana Loki + Promtail: Lightweight log aggregation
Detection rules¶
Elastic SIEM detection rule¶
- rule: name: Multiple Failed Logins type: threshold query: ‘event.category:authentication AND event.outcome:failure’ threshold: field: source.ip value: 10 severity: high interval: 5m
Key Takeaway¶
SIEM = central visibility. Wazuh for budget, Elastic SIEM for flexibility, Splunk/Sentinel for enterprise.
securitysiemmonitoringsoc