SIEM Engineering

SIEM engineers build and run the platform the SOC depends on: collecting, parsing, storing and searching logs, and keeping detections healthy. You need Linux basics and a lab.

• Have a lab with a few log sources
• Know basic networking
• Plan your study time

• CyberA4U Academy — courses

A SIEM has collectors, a processing pipeline, storage, a search engine and a detection engine. Design choices affect cost, speed and reliability.

• Explain SIEM components
• Plan for scale and reliability
• Choose between self-hosted and SaaS

الأدوات والتقنيات: SIEM

• Wazuh — Architecture

Agents and shippers such as Filebeat or Fluent Bit collect logs reliably, buffer them and send them securely.

• Deploy log shippers
• Buffer and retry to avoid loss
• Encrypt data in transit

الأدوات والتقنيات: SIEM

• Filebeat overview
• Fluent Bit manual

Parsers turn raw text into fields; normalization maps them to a common schema such as ECS so searches and rules work across sources.

• Write parsers for new sources
• Map fields to a schema
• Handle parsing failures

الأدوات والتقنيات: SIEM

• Elastic Common Schema (ECS) reference

A consistent schema (ECS, OCSF or your own) is what makes detections portable and investigations fast.

• Choose or design a schema
• Document field names and types
• Enforce it for new sources

الأدوات والتقنيات: SIEM

• Open Cybersecurity Schema Framework (OCSF)

Storage tiers (hot, warm, cold, archive) balance search speed and cost; retention must meet investigation and legal needs.

• Plan retention per log source
• Use index lifecycle management
• Balance cost and access speed

الأدوات والتقنيات: SIEM

• Elasticsearch — Index lifecycle management

Dashboards give analysts situational awareness: alert volumes, top sources, data health and trends.

• Build dashboards for analysts and managers
• Avoid vanity charts
• Keep dashboards fast

الأدوات والتقنيات: SIEM

• Kibana — Dashboards

Correlation rules combine events over time to detect attack patterns a single event can't reveal.

• Write threshold and sequence rules
• Use a portable format such as Sigma
• Test rules against sample data

الأدوات والتقنيات: SIEM

• Sigma — Rules basics

User and entity behavior analytics learns normal behavior and flags anomalies such as unusual logins or data access.

• Explain baselining and anomaly scoring
• Understand UEBA strengths and false positives
• Combine UEBA with rules

الأدوات والتقنيات: SIEM

• Microsoft Sentinel — Entity behavior analytics (UEBA)

SOAR automates enrichment and response steps triggered by SIEM alerts, saving analyst time.

• Choose tasks to automate
• Integrate SIEM alerts with a SOAR platform
• Keep humans in the loop for risky actions

الأدوات والتقنيات: SIEM

• Microsoft Sentinel — Automation

A silent log source is a blind spot. Monitor ingestion volumes, parsing errors and pipeline delays.

• Alert on missing or delayed sources
• Track parsing errors
• Monitor platform resources

الأدوات والتقنيات: SIEM

• Microsoft Sentinel — Health and audit monitoring

SIEM cost grows with data volume. Filtering noisy logs, tiered storage and sending only useful fields keep it under control.

• Measure volume per source
• Filter or summarize low-value data
• Use cheaper tiers for long retention

الأدوات والتقنيات: SIEM

• Elasticsearch — Index lifecycle management

MSSPs and large organizations run one SIEM for many tenants, which requires strict data separation and per-tenant access.

• Separate tenant data
• Scope access and detections per tenant
• Report per tenant

الأدوات والتقنيات: SIEM

• Wazuh documentation

Migrating between SIEMs means moving data sources, parsers, detections and dashboards without losing coverage.

• Inventory sources and detections
• Run old and new in parallel
• Validate coverage before cutover

الأدوات والتقنيات: SIEM

• Microsoft Sentinel — Plan your SIEM migration

Put it all together by building a full pipeline: sources, shippers, parsing, storage, detection and a dashboard.

• Build an end-to-end log pipeline
• Validate data quality
• Document it

الأدوات والتقنيات: SIEM

• Wazuh — Quickstart

Check that you can build, operate and troubleshoot a SIEM pipeline that analysts can rely on.

• Collect, parse and normalize logs
• Manage retention and cost
• Monitor pipeline health

• CyberA4U CTF Arena — practice challenges

You can now engineer SIEM platforms. Continue with Detection Engineering, Log Analysis or Cloud Detection & Response.

• Keep your pipeline running
• Choose your next roadmap
• Share your pipeline design

• CyberA4U CTF Arena — practice challenges