SIEM and analytics solutions

A SIEM solution is a key component of any blue team arsenal. Many companies offer SIEM solutions, including Splunk, Elastic, IBM (QRadar), HP (ArcSight), XPalo Alto Networks (XSIAM), LogRhythm, and Exabeam, to mention a few.

The main goal of a SIEM solution is to collect data as inputs, centralize them, and allow correlations between those events with the objective of providing alerts, dashboards, or reports as outputs. We can define a high-level workflow of a SIEM system with these different components (already described in Chapter 6, Blue Team – Collect):

• Events collection: This is where we collect our raw data sources, such as Windows events, Linux logs, and intrusion detection system (IDS) events.
• Event normalization: The collected events are normalized usually using a data model such as Splunk Common Information Model (CIM) or Elastic Common Schema (ECS). At this step, a field called username for one data source and a field called...