SIEM, Log Sources & Detection

A SIEM centralises logs from endpoints, servers, firewalls and cloud, then correlates them into alerts. Examples: Splunk, Elastic, Microsoft Sentinel, Wazuh (open source).

Log sources that matter most: Windows Security Event logs (4624 logon, 4625 failed logon, 4688 process creation), Sysmon, EDR telemetry, firewall/proxy logs, DNS logs.

Detection engineering is writing rules that catch malicious behaviour with few false positives. The MITRE ATT&CK framework maps adversary techniques so you can measure coverage.

Golden rule: detect behaviour, not just indicators. A hash blocks one file; a rule for "office app spawning powershell with encoded command" catches a whole class of attacks.