Internship
Student login
← SOC & SIEM learning path
SOC & SIEM · Module 3 of 10

SIEM fundamentals

Centralise and correlate security events.

📖 Key ideas

  1. SIEM collects, stores, normalises and correlates logs.
  2. Correlation rules link events into alerts (e.g. many failed logins then success).
  3. Dashboards show security posture.
  4. Popular SIEMs: Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security, Wazuh.
  5. Tune rules to reduce false positives.
💡 Real-life example: A SIEM is a detective's pinboard connecting clues from many places into one story.
SIEMSecurity Information and Event Management
Correlation ruleLogic linking events
False positiveAlert for harmless activity
Use caseSpecific detection scenario