SIEM Fundamentals

Critical Log Sources (mandatory for any SIEM):
  └─ Authentication: Windows Event ID 4624/4625, SSH auth.log, VPN logs
  └─ Network: Firewall denies, NetFlow, DNS queries, proxy logs
  └─ Endpoint: EDR alerts, process creation (4688), PowerShell (4104)
  └─ Cloud: AWS CloudTrail, Azure Activity Log, GCP Audit Log
  └─ Application: Web server access logs, API gateway logs
  └─ Database: Audit logs, failed login attempts
  └─ Email: DMARC reports, spam filter logs, mailbox audit

Example Correlation Rules:

Single Event (simple match):
  Rule: "Windows Event ID 4625 (failed login) > 10 in 5 minutes"
  Action: Alert SOC analyst
  Tuning: Exclude service accounts, known admin jump boxes

Multi-Event (sequence across sources):
  Rule: "Firewall deny for outbound port 445" followed by
        "Windows Event 4688 (process creation) for cmd.exe" on same host
  Action: Escalate to Tier 2 — possible lateral movement

Threat Intel Match:
  Rule: "DNS query to known C2 domain from internal IP"
  Action: Block IP at firewall, alert SOC
  Source: MISP/CrowdStrike threat intel feed

Statistical Baseline:
  Rule: "Outbound traffic volume > 5x baseline for 5 minutes"
  Action: Alert — possible data exfiltration
  Consideration: Exclude backup windows

# Splunk SPL (Search Processing Language)

# Detect brute force: 10+ failed logins per source IP in 5 minutes
index=windows EventCode=4625
| stats count by Source_Network_Address
| where count > 10
| join type=inner Source_Network_Address
  [ search index=windows EventCode=4624
  | stats values(User_Name) as SuccessUsers by Source_Network_Address ]
| table Source_Network_Address, count, SuccessUsers

# Detect anomalous outbound traffic by host
index=netflow bytes_out > 1000000
| stats sum(bytes_out) as TotalBytes by src_ip, dest_ip
| eventstats avg(TotalBytes) as AvgBytes, stdev(TotalBytes) as StdDev by src_ip
| where TotalBytes > (AvgBytes + 3*StdDev)
| sort - TotalBytes
| table src_ip, dest_ip, TotalBytes

# Elastic Security detection rule
rule:
  name: "Suspicious PowerShell Execution"
  description: "Detects PowerShell launched with hidden window or encoded commands"
  risk_score: 47
  severity: medium

  query: |
    event.code: 4104 AND
    powershell.command.encoded: * AND
    NOT powershell.command: *-WindowStyle Hidden

  timeline_template: "powershell-analysis"

  actions:
    - type: "webhook"
      frequency: "per_run"
      body: "Alert: Suspicious PowerShell on {{host.name}}"

RAW EVENT (SIEM alert fires)
    │
    ▼
TRIAGE (Tier 1 Analyst, < 15 minutes)
    ├─ Is this a known false positive? → Close + update tuning
    ├─ Is this a known benign activity? → Close + add to whitelist
    └─ Is this potentially malicious? → Escalate to Tier 2
    │
    ▼
INVESTIGATION (Tier 2 Analyst)
    ├─ Check related events (login, process, network)
    ├─ Query threat intelligence feeds
    ├─ Check host for IOCs
    └─ Determine if this is a true positive
    │
    ▼
RESPONSE (Tier 3 / Incident Response)
    ├─ True positive → Open incident, initiate IR playbook
    └─ False positive → Document and return to tuning

What Happened:
  └─ Target had deployed FireEye (now Trellix) for malware detection
  └─ FireEye detected the POS malware in September 2013 (weeks before breach disclosure)
  └─ FireEye alerted Target's SOC in Bangalore, India
  └─ SOC analyst reviewed the alert and determined it was NOT a threat
  └─ No escalation was triggered
  └─ FireEye continued alerting for weeks — each alert dismissed
  └─ SMTP allowlist allowed the data exfiltration to go through
  └─ Breach discovered only after US Department of Justice alerted Target

Why SIEM Failed:
  └─ No escalation path for unacknowledged alerts
  └─ No SIEM correlation between FireEye alerts and other events
  └─ Alert fatigue — too many alerts, too few analysts
  └─ No automated blocking (IPS/EDR) as backup
  └─ No metrics tracked on time-to-acknowledge or alert disposition

Lessons Learned:
  └─ Every alert must have an escalation path
  └─ If not acknowledged in 15 minutes → escalate to senior analyst
  └─ If still not acknowledged in 30 minutes → page CISO
  └─ Automated responses: block, quarantine, contain
  └─ SIEM correlation: link related alerts for context
  └─ Track metrics: time to detect, time to respond, alert volume trends

Planning Phase:
  └─ Define use cases (what attacks to detect?)
  └─ Map compliance requirements (PCI, HIPAA, SOC 2)
  └─ Estimate daily log volume (EPS — events per second)
  └─ Determine retention requirements
  └─ Budget for licensing, hardware, staffing

Build Phase:
  └─ Deploy log collectors (syslog-ng, fluentd, beats)
  └─ Configure log sources for security-relevant events
  └─ Test log ingestion (verify all sources sending)
  └─ Install base correlation rules
  └─ Create dashboards for SOC operations

Operate Phase:
  └─ Tune rules weekly (reduce false positives)
  └─ Review missed detection opportunities
  └─ Update threat intelligence feeds
  └─ Test alert-to-incident workflow
  └─ Track and report SIEM metrics

Mature Phase:
  └─ Implement UEBA for anomaly detection
  └─ Automate response playbooks (SOAR integration)
  └─ Threat hunting based on SIEM data
  └─ Predictive analytics