SIEM & Log Analysis
Collecting the evidence, writing the detections, and keeping the alert queue small enough that someone reads it.
One Place To Ask Questions
A SIEM — security information and event management — collects logs from across the estate, normalises them into a common shape, and lets you query and alert across all of them at once. Without one, an investigation means logging into fifteen systems and correlating timestamps by hand.
| Function | Purpose |
|---|---|
| Collection | Agents and forwarders pulling logs from everything |
| Normalisation | Different formats into common fields — user, source, action |
| Correlation | Rules across sources: a failed VPN login then a successful one elsewhere |
| Alerting | Turning a matched pattern into work for a human |
| Retention | Evidence still available months later, when you learn you were breached |
Log Sources That Earn Their Place
Ingesting everything is expensive and drowns the signal. The useful question for each source is which detection it enables.
| Source | Detects |
|---|---|
| Authentication and identity | Credential stuffing, impossible travel, privilege changes |
| Endpoint (EDR) | Malware, suspicious process trees, persistence |
| Network and DNS | Command and control, exfiltration, unusual destinations |
| Cloud control plane | New keys, policy changes, resources created in odd regions |
| Application logs | Business-logic abuse nothing else can see |
| Email gateway | Phishing — still the most common initial access |
Detections & Alert Fatigue
A detection is a rule that says this pattern is worth a human's attention. The whole craft is precision: an alert nobody can act on is worse than no alert, because it trains the team to close the queue without reading it.
| Detection type | Example |
|---|---|
| Signature | A known malicious hash or domain |
| Threshold | Twenty failed logins in a minute |
| Correlation | Failed logins, then a success, then a new mailbox rule |
| Anomaly | A service account behaving unlike its baseline |
| Absence | A log source that stopped reporting — often the first sign |
Every detection needs a written response: what it means, how to verify it, what to do if true, and what to check if false. A rule that fires with no runbook produces an alert nobody knows how to close.
The SOC Workflow
| Stage | Question |
|---|---|
| Triage | Is this real, and how urgent |
| Investigation | What else did this account or host do |
| Containment | Isolate, disable, block — stop it spreading |
| Eradication | Remove the access and close the way in |
| Recovery | Restore service, verify it is clean |
| Lessons learned | What detection would have caught this sooner |
The metrics that matter are time to detect and time to contain. Alert volume and rule count measure activity, not effectiveness, and optimising for them makes the queue worse.
Threat Hunting
Hunting is the deliberate search for what the detections missed — starting from a hypothesis rather than an alert. "If an attacker were using this technique, what would it look like in our logs?"
| Hunt starts from | Example |
|---|---|
| A technique | Scheduled tasks used for persistence |
| An anomaly | A workstation talking to a cloud region nobody uses |
| Threat intelligence | Indicators tied to a group targeting your sector |
| A gap | An asset class with no detection coverage at all |
Two outcomes are both successes: finding something, or finding nothing and converting the hunt into a permanent detection so it never has to be done manually again.
Interview Questions
What does a SIEM actually do?
Collects logs from across the estate, normalises them into common fields, correlates events across sources, raises alerts, and retains evidence long enough for an investigation months later.
Why not ingest every log you have?
Cost and signal. Each source should justify itself by the detections it enables; ingesting everything drowns the useful events and inflates the bill.
What is alert fatigue and why is it dangerous?
A queue so noisy that analysts triage by pattern rather than reading. The real alert passes unread — which is why tuning is the work rather than maintenance.
Why alert on the absence of logs?
A source that stops reporting is often the first sign of a compromised host or a broken pipeline, and nothing else will notice it.
Which SOC metrics matter?
Time to detect and time to contain. Alert volume and rule count measure activity, and optimising for them makes the queue worse.
What is threat hunting?
Hypothesis-driven searching for what detections missed. Finding nothing is still a success if the hunt becomes a permanent detection.