SOC Architecture and Threat Detection

What Is a SIEM?

A SIEM collects logs from firewalls, servers, endpoints, network devices, and applications, normalizes them into a common schema, stores them for search, and runs correlation rules that generate alerts when attack patterns are detected. Commercial SIEMs: Splunk, Microsoft Sentinel, IBM QRadar, Exabeam. Open source: Elastic SIEM (ELK Stack), Wazuh, OSSIM. A Tier 1 analyst spends their day triaging SIEM alerts.

Log Sources and Collection

Critical log sources: Windows Event Logs (login events, privilege use, process creation), Linux syslog/auditd, firewall logs (allow/deny with IP:port), DNS query logs (detect C2 and data exfiltration), proxy/web gateway logs (URLs visited), and EDR telemetry (file, process, network activity). Collection agents (Beats, NXLog, Splunk UF) forward logs to the SIEM over encrypted channels.

Log Normalization and Parsing

Logs come in dozens of formats: syslog, CEF, LEEF, JSON, Windows XML Event. The SIEM must parse each format and map fields to a common schema. In Splunk this is done with field extractions. In the Elastic Stack, Logstash grok patterns and Filebeat modules handle parsing. Good normalization lets you write one detection rule that works across all log sources.

# Deploy Wazuh SIEM (Docker)
docker-compose -f /path/to/wazuh/docker-compose.yml up -d

# Or: Elastic Stack quick setup
docker run -d --name elasticsearch -p 9200:9200 \
  -e 'discovery.type=single-node' elasticsearch:8.12.0

docker run -d --name kibana -p 5601:5601 \
  --link elasticsearch:elasticsearch kibana:8.12.0

# Filebeat: ship logs to Elasticsearch
# /etc/filebeat/filebeat.yml
# filebeat.inputs:
# - type: log
#   paths: ['/var/log/auth.log', '/var/log/syslog']
# output.elasticsearch:
#   hosts: ['localhost:9200']

filebeat setup --dashboards
systemctl start filebeat

# Query logs in Elasticsearch
curl -X GET 'localhost:9200/filebeat-*/_search' -H 'Content-Type: application/json' -d '
{"query": {"match": {"event.action": "failed-login"}}}'