Firewall
← Plain Library
Security monitoring · Plainly explained
SIEM Security Information & Event Management
Bring security events from across your infrastructure into one place, connect the dots, detect suspicious activity, and alert your security team.
SIEM collects logs from different systems, analyzes them, correlates related events, and generates security alerts when suspicious activity is detected.
Explore how SIEM worksFirewall
EDR
Windows
Linux
Cloud
Applications
Network
LIVE ANALYSISSIEMCollect · Connect · Detect
01 / WHY SIEM?
Every tool sees a fragment. SIEM sees the story.
A modern IT environment contains many security tools, servers, apps, identities, and cloud services. Each one records only its own part of what happened. Those records are called logs.
EDR / Antivirus
IDS / IPS
VPN
Active Directory
Windows Servers
Linux Servers
Routers & Switches
Cloud Platforms
SaaS Applications
Databases
Identity & Access
Business Applications
01VPN login+02AD authentication+03EDR activity+04Firewall traffic
POSSIBLE THREATAccount compromiseFour related events · one security story
THE CENTRAL IDEASIEM connects the dots.It can collect useful logs from security products and from ordinary IT systems, applications, databases, cloud platforms, and devices.
02 / ROLE OF SIEM
A secondary line of defence—watching while events unfold.
SIEM is primarily a monitoring and detection technology. It observes what is happening, identifies suspicious activity, and tells the security team what deserves attention.
Controls designed to block, limit, or resist threats.
Observes activity and detects suspicious patterns as events occur.
Analysts decide what happened and how serious it is.
People and integrated tools contain and remediate the threat.
CORE CHARACTERISTIC
SIEM is largely passive in nature.
It captures events, collects logs, correlates activity, detects suspicious patterns, generates alerts, and provides visibility. It does not inherently prevent every attack.
- Can detect activity during an attack
- Does not need to wait until an attack is over
- Focuses on monitoring, detection, and alerting
- Can integrate with SOAR, EDR, firewalls, IAM, and other response systems
03 / WHAT ARE LOGS?
A log is a record of something that happened.
Logs are the raw material of a SIEM. A useful event usually answers several simple questions: who acted, what happened, when and where it happened, and whether the action succeeded.
event.log● ● ●
User: john
Source IP: 10.10.10.25
Destination: Server01
Action: Login
Result: Failed
Time: 10:30:15User
johnAction
LoginTime
10:30:15IP / Device
10.10.10.25Outcome
Failed04 / LOG COLLECTION
Before SIEM can analyze a log, the log must reach it.
Different technologies use different collection methods. Some send events continuously, while others let a collector retrieve them on a schedule.
Syslog
A common way for network and security devices to send event messages.
Firewall
Syslog
Collector
SIEM
Collection notes
514 uses UDP or TCP. 6514 commonly uses TLS encryption.
Firewalls · routers · switches · IDS/IPS · Linux · appliancesWindows Event Forwarding
Windows Event Logs can be forwarded with WEF, commonly over WinRM.
Windows
WEF / WinRM
Collector
SIEM
Collection notes
Authentication can use Windows credentials or other supported mechanisms.
Windows clients · Windows servers · domain controllersAgent-based
Installed software reads local logs and forwards them to a collector or SIEM.
Endpoint
Agent
Collector
SIEM
Collection notes
Agents may filter, buffer, encrypt, or preprocess events before sending them.
Servers · endpoints · applications · custom log filesREST API
A collector retrieves events from an HTTP-based interface exposed by a service.
Cloud / SaaS
REST API
Collector
SIEM
Collection notes
API credentials, tokens, certificates, and rate limits may control access.
Cloud · SaaS · identity platforms · security platformsDatabase
A collector reads event records stored by an application in a database.
App database
ODBC / JDBC
Collector
SIEM
Collection notes
The connection should use a narrowly scoped account and protected transport.
Business apps · audit databases · legacy systems05 / LOG FORMATS
Transport is the journey. Format is the shape of the data.
These ideas are often mixed together. Transport describes how the event travels. Format describes how its data is organized.
Syslog connection · WEF · agent · REST API · database connection
Syslog message · CEF · LEEF · JSON · CSV · Windows Event XML
Common text-based event format used by systems and network devices.
Common Event Format: a structured security-event format.
Log Event Extended Format: another structured security-event format.
Key-and-value format used by modern apps, cloud services, and APIs.
Comma-Separated Values: data arranged into rows and columns.
Structured Windows events with fields such as Event ID, provider, user, process, and time.
event.jsonJSON
{
"user": "john",
"source_ip": "10.10.10.25",
"action": "login",
"status": "failed"
}event.csvCSV
Time,User,SourceIP,Action,Status
10:30:15,john,10.10.10.25,login,failedWINDOWS EVENT FIELDS
Event IDProviderComputerUserTimeProcessCommand06 / PUSH VS PULL
Who starts the conversation?
That one question separates the two collection models.
PUSHSOURCE INITIATES
DEVICECOLLECTOR
The source sends logs to a destination.
- Destination IP or hostname
- Destination port and protocol
- Security settings where applicable
Firewall → Port 514 → CollectorPULLCOLLECTOR INITIATES
COLLECTORDEVICE / CLOUD
The collector connects to the source and asks for logs.
- Source IP, hostname, and port
- User ID and password where used
- API credentials, tokens, or certificates
Collector → REST API → Cloud logsPush = Source sends the data.Pull = Collector asks for the data.
07 / COMPLETE ARCHITECTURE
From scattered events to a searchable security story.
Follow the main path down. Select any component to open a plain-language explanation. The archive branch keeps events for later investigation, compliance, auditing, and historical analysis.
01Event Sources+
Systems that create security or operational events.
Firewall · EDR · Windows · Linux · cloud · apps · databases · network devices02Log Collector+
Receives pushed logs or retrieves them from sources.
Syslog · WEF · agents · REST APIs · database connections03Decoder / Parser+
Turns raw text into meaningful fields the SIEM can understand.
User · action · result · source IP · time04Metadata & Normalization+
Extracts useful details and maps different field names to common concepts.
src_ip · IpAddress · sourceIPAddress → Source IP05Concentrator / Indexing+
Organizes events so searches across large volumes remain fast.
Find every failed login by John in the last 24 hours06Event Stream Analyser+
Checks events as they arrive for rules, patterns, thresholds, and correlations.
Real-time analysis · rule matching · pattern matching · threat detection07Security Analytics+
Gives analysts the views and tools used to investigate.
Dashboards · alerts · search · reports · threat hunting · compliance08SOC+
The people and processes that triage alerts, investigate evidence, and coordinate response.
Triage · investigation · decision · escalation · responseARCHIVE BRANCH
ArchiverRetains event data for later use.User john failed login from 10.10.10.25- User
- john
- Action
- Login
- Result
- Failed
- Source IP
- 10.10.10.25
WHY NORMALIZATION MATTERS
Different names. One common concept.
Mapping equivalent fields makes correlation across unrelated products much easier.
Firewall
src_ipWindows IpAddressCloud sourceIPAddressSource IP08 / RULES & CORRELATION
Where SIEM becomes smart.
A rule defines a condition that should trigger an alert. Correlation connects related events to reveal a larger security story.
RULE CONDITIONMore than 10 failed logins from the same IP within 5 minutesALERT
01VPN login from unusual location02Successful authentication03Privileged account used04Critical server access05Large data transfer
CORRELATION
POSSIBLE INCIDENTAccount compromise / data exfiltration
One event may not be suspicious. Several related events together can tell a very different story.
Threshold rules
More than 10 failed logins in 5 minutes.
Sequence rules
Failed login → success → privilege escalation → sensitive file access.
Correlation rules
VPN + Active Directory + EDR + firewall activity.
Pattern-based rules
PowerShell + encoded command + suspicious network connection.
Time-based rules
50 authentication failures within 2 minutes.
09 / FROM LOG TO ALERT
One event. Fourteen stages. One informed decision.
The complete path shows how raw activity becomes something an analyst can investigate.
- 01Event occurs
- 02Source generates log
- 03Log transport
- 04Log collector
- 05Decoder / parser
- 06Metadata extraction
- 07Normalization
- 08Indexing / storage
- 09Correlation & detection
- 10Rule match
- 11Alert
- 12SOC analyst
- 13Investigation
- 14Response
10 / UNDERSTANDING ALERTS
An alert is a question—not proof of an attack.
A SIEM says, “This activity matches something worth checking.” A security analyst must investigate the context and decide what actually happened.
10 FAILED LOGINSObserved activity
SIEM ALERTRule matched
INVESTIGATIONAnalyst checks evidence
Brute-force attackUser forgot passwordApplication issueAutomated service
The SIEM alerts, but the activity is legitimate.
AlertInvestigationNormal activity
A real attack occurs, but the SIEM does not detect it.
AttackNo alert
Good SIEM engineering tries to reduce both.
SIEM ALERT LIFECYCLE
Detection begins the work. It does not finish it.
- 01Event
- 02Detection rule
- 03SIEM alert
- 04Triage
- 05Investigation
- 06True / false positive
- 07Incident response
- 08Containment
- 09Remediation
- 10Recovery
- 11Lessons learned
11 / SIEM & SOC
SIEM is the technology. SOC is the team around it.
A SOC combines people, processes, and technologies to monitor and respond to security incidents. Analysts triage alerts, collect evidence, assess impact, and coordinate the next action.
LogsSIEMAlertsSOC analystInvestigationResponse
12 / SIEM VS SECURITY TOOLS
SIEM brings their information together—it does not replace them.
TechnologyPrimary purpose
FirewallControls network traffic
AntivirusDetects and blocks malware
EDRMonitors and responds to endpoint activity
IDS / IPSDetects or prevents suspicious network activity
IAMManages identities and access
DLPHelps protect sensitive data
SIEMCollects, correlates, analyzes, and alerts
SOARAutomates and orchestrates security response
13 / SIEM + SOAR
Detection meets automated response.
SIEM focuses on monitoring and detection. SOAR coordinates tools and automates approved response steps.
Modern SIEM platforms can integrate with SOAR, EDR, firewalls, IAM, and other systems to enable automated response. Automation should still follow carefully reviewed rules because a mistaken action can disrupt legitimate users.
14 / WHAT MAKES SIEM EFFECTIVE?
Technology is only one part of the system.
A SIEM is only as effective as the data, detection rules, and processes around it.
- ✓01Good log coverage
- ✓02High-quality logs
- ✓03Correct parsing
- ✓04Proper normalization
- ✓05Useful correlation rules
- ✓06Low false-positive rate
- ✓07Appropriate log retention
- ✓08Useful dashboards
- ✓09Well-tuned alerts
- ✓10Skilled SOC analysts
15 / WHAT SIEM DOES NOT DO
SIEM is not a magic security product.
It cannot guarantee that every attack will be detected.
Detection can fail when…
- A device does not generate the required log
- Logs are not being sent
- Logs are incorrectly parsed
- Important fields are missing
- Detection rules are poorly configured
- Alerts are ignored
SIEM visibility depends on log coverage, log quality, detection engineering, and analyst investigation.
16 / FINAL SUMMARY
SIEM in 7 simple steps.
Collect
Get logs from different systems.
Transport
Bring logs in through Syslog, WEF, agents, APIs, databases, and more.
Parse
Understand the structure and fields inside each log.
Normalize
Map different log structures into common security concepts.
Index & store
Organize events for fast search and suitable retention.
Correlate & detect
Connect related events and apply detection rules.
Alert & investigate
Tell the SOC what needs attention so analysts can respond.
THE SHORT VERSION
Think of SIEM as the security control room of your IT environment: many systems send it information, SIEM connects that information, identifies suspicious activity, and brings the important events to the attention of the security team.
Return to the top ↑