Splunk SIEM (SOC Analyst & SIEM Engineer) → SIEM architecture

SIEM architecture

Security Incident and Event management (SIEM)

It is basically monitoring all incoming and outgoing traffic logs using some automated software with human analyzing the alerts generated by system.

SIEM is a capability which consist of tools that are also called SIEM(pretty confusing to be honest).

SIEM works by running all logs fed to it against some rules called USE CASES and then trigger alerts based on those rules. These alerts are 24*7 monitored by SIEM team. SIEM team comprises of Junior Analyst(L1), Analyst(L2), senior analyst(L3), SIEM admin(L3), SIEM manager, Architect.

L1 basically sees if alert is false positive or negative(genuine alert or not).

If L1 is not able to analyze the issue it passes it on to L2 who then identifies important mitigation actions and pass it on to relevant teams in SOC(antivirus team, Firewall team etc).

L3/SIEM admin usually configures the USE CASES, updates new rules against new threats. L3 also solves complicated issues like log source configuration, SIEM configuration, immediate threats, diagnose complex issues.

SIEM manager generally sees health report of system and check team and cross team functioning. SIEM manager is often a technical guy.

Architect is often shared among multiple team. He is the guy who comes into play when they setup SIEM first time or the guy who helps L3 with complicated stuff.

There are diff SIEM in market, mostly divided into Cloud SIEM and conventional SIEM.

Popular cloud SIEM are azure sentinel, splunk cloud etc.

Popular conventional SIEM are splunk, archsight, IBM Qradar etc.

Splunk: Splunk Enterprise is the core of their SIEM solution and provides collection and storage of data. It

can be extended with different packages, which for example extend it by user behavior analytic capabilities.

IBM QRadar: IBM QRadar is a modular system and therefore is applicable for medium to large size companies. Furthermore it can be deployed as a standalone system, in a distribute architecture or in the cloud.

LogRhythm: LogRhythm provides host and network monitoring abilities in addition to core SIEM functionalities.

Furthermore, an AI engine aims at automating certain operations.

McAfee ESM: McAfee ESM can be connected with a threat intelligence feed, which provides additional

information and signatures. Furthermore, it supports big data technologies like Elasticsearch and Kafka.

AlienVault USM & OSSIM: Compared to the previously mentioned systems, AlienVault OSSIM is distributed

as open source software. Thereby, it is the most widely used SIEM system of this kind. AlienVault USM is a

paid version of OSSIM hosted in a cloud environment extended by additional features.

Section 1 Basic
This section covers the basic of SOC, SIEM and IT security

Section 2 Intermediate
This section covers the day to day working concepts and scenarios of an IT security Analyst. This section is of intermediate level.

Section 3 Advanced
This section covers advanced concept of IT security like SIEM integration and real world use cases. This section build on intermittent skills gained from previous section.