🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Security Information and Event Management (SIEM) › Lesson 1
TEC-CYBE44-06 · Lesson 1 · 10 clock hours · theory

SIEM Fundamentals and the Security Operations Workflow

Objective. Students explain the architecture and core functions of a SIEM platform and describe how SIEM fits within a security operations center (SOC) workflow.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

What Is a SIEM?

A Security Information and Event Management (SIEM) platform collects, normalizes, correlates, and stores log and event data from across an organization's IT environment. The name combines two older disciplines: Security Information Management (long-term log storage and reporting) and Security Event Management (real-time alerting). Modern SIEM tools do both simultaneously, giving security analysts a single pane of glass to monitor threats, investigate incidents, and demonstrate compliance.

Common commercial and open-source SIEM platforms include Splunk, Microsoft Sentinel, IBM QRadar, and the Elastic Security stack. Despite differences in interface and licensing, all of them share the same fundamental architecture.

Core SIEM Architecture

Log Collectors / Forwarders

Log collectors (sometimes called forwarders or agents) run on endpoints, servers, firewalls, and other network devices. Their job is to gather raw event data — Windows Event Logs, syslog messages, firewall deny records, authentication events — and forward it to the SIEM. Lightweight agents minimize impact on the source system. Agentless collection uses protocols such as syslog over UDP/TCP or the Windows Event Forwarding (WEF) mechanism.

Indexers

Indexers receive the incoming data stream, parse it into structured fields, and write it to a searchable data store. Parsing converts unstructured log text into key-value pairs (for example, `src_ip=10.0.0.5`, `action=denied`). Normalization maps different vendors' field names to a common schema so that a firewall deny and an IDS drop can be compared in the same query. Storage is typically time-series and compressed to keep costs manageable at high data volumes.

Search Heads

The search head is the query interface. Analysts write searches in the platform's own query language (SPL in Splunk, KQL in Elastic/Sentinel) to hunt for indicators, build dashboards, and investigate alerts. In distributed deployments, the search head sends queries to multiple indexers in parallel and merges results before presenting them to the user.

Correlation Engine

The correlation engine applies rules — logical conditions that span multiple events and sources — to identify suspicious patterns in near real time. A simple rule might fire when five failed logins to the same account occur within sixty seconds. A more complex rule chains events across different data sources: failed logins followed by a successful login from an unusual country, then a large outbound file transfer. When a rule fires, the SIEM creates an alert (sometimes called a notable event or finding) that lands in the analyst's queue.

How SIEM Fits in the SOC Workflow

A Security Operations Center (SOC) is the team and facility responsible for continuous monitoring and response. SOCs are typically organized in tiers:

SIEM data is central at every tier. The alert queue that Tier 1 watches is generated by correlation rules. The log search that Tier 2 uses to trace an attacker's lateral movement queries the indexer. The hunting hypothesis that Tier 3 tests is written as a search head query.

The Incident Alert Lifecycle

1. Event generation: A source system (endpoint, firewall, identity provider) logs an activity.

2. Collection: The log forwarder captures and sends the event to the SIEM.

3. Normalization and indexing: The indexer parses and stores the event.

4. Correlation: The correlation engine evaluates rules and creates an alert if conditions match.

5. Triage: A Tier 1 analyst reviews the alert, gathers context, and classifies it.

6. Investigation: A Tier 2 analyst queries related logs, builds a timeline, and determines impact.

7. Response and remediation: Containment actions are taken (isolating a host, resetting credentials, blocking an IP).

8. Documentation and lessons learned: The incident is recorded; rules and playbooks are updated.

Ethical and Professional Responsibilities

SIEM platforms ingest data that includes personal and sensitive employee information. Analysts must handle log data according to organizational policy, applicable privacy law, and the principle of least privilege — accessing only the data needed to perform the investigation. Misuse of SIEM access for unauthorized surveillance is both an ethical violation and potentially a legal one. Maintain chain of custody practices when log data may be needed as evidence.

Why This Matters for Your Credentials

SIEM architecture, SOC workflows, and alert triage are tested on both CompTIA Security+ and CompTIA CySA+. The ISC2 CC exam also covers security operations concepts. Understanding these fundamentals gives you the language and mental model to answer scenario-based exam questions and to perform real analyst tasks from your first day on the job.

Key terms9

SIEMSecurity Information and Event Management; a platform that aggregates, normalizes, correlates, and stores log and event data to support real-time monitoring, alerting, and compliance reporting.
Log Collector / ForwarderAn agent or agentless mechanism installed on a source device that gathers raw event data and sends it to the SIEM indexer.
IndexerThe SIEM component that parses incoming log data into structured fields, normalizes it against a common schema, and writes it to a searchable data store.
Search HeadThe query and visualization interface of a SIEM that allows analysts to search indexed data, build dashboards, and investigate alerts using the platform's query language.
Correlation EngineThe SIEM component that applies logical rules across multiple events and data sources to detect suspicious patterns and generate alerts in near real time.
NormalizationThe process of mapping log fields from different vendors and formats to a common schema so that disparate event types can be queried and compared uniformly.
SOC (Security Operations Center)The team and facility responsible for continuous monitoring of an organization's security posture, alert triage, incident response, and threat hunting.
Alert TriageThe Tier 1 analyst activity of reviewing a SIEM-generated alert, gathering initial context, and determining whether it represents a true positive incident requiring escalation.
True Positive / False PositiveA true positive is an alert that correctly identifies malicious or policy-violating activity; a false positive is an alert triggered by benign activity that matched a correlation rule.
In class: Annotated diagram exercise: students label a SIEM architecture diagram identifying log collectors, indexers, search heads, and correlation engines, then explain each component in writing. · Paired reading and discussion of a publicly available SOC analyst job description and a SIEM vendor data sheet (e.g., Elastic Security or Splunk Free Trial documentation); students list five real analyst tasks that depend on SIEM data. · Class mapping activity: students place six common SOC alert types (failed login, malware detection, data exfiltration, port scan, privilege escalation, beaconing) onto a simplified incident lifecycle diagram and describe what SIEM role each step requires.
Materials: Whiteboard/projection, annotated SIEM architecture handout, SOC analyst job posting printouts, Splunk or Elastic Security free-tier documentation, CompTIA CySA+ official study guide (Security Operations chapter)
Check: Exit quiz of 10 multiple-choice questions covering SIEM components, SOC tiers, and alert lifecycle; pass mark 70%.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Security Operations (CySA+) / Threats, Attacks and Vulnerabilities (Security+)
1. Which SIEM component is responsible for applying logical rules across multiple events to generate alerts?
Security Operations (CySA+)
2. An analyst needs to search indexed log data to trace an attacker's lateral movement across five servers. Which SIEM component does the analyst interact with directly?
Security Operations (CySA+) / Security Operations (ISC2 CC)
3. A Tier 1 SOC analyst receives a SIEM alert for five failed logins to the same account in under a minute. After reviewing context, she determines the account belongs to a developer who mistyped a password. What is the correct classification?
Security Operations (CySA+)
4. Which process converts vendor-specific log field names into a common, consistent schema inside the SIEM?
Security Operations (CySA+) / Security Operations (ISC2 CC)
5. A SOC is organized into three tiers. Which tier is primarily responsible for proactively hunting for threats that existing correlation rules have not detected?
Security Operations (CySA+)
6. In the SIEM incident alert lifecycle, what happens immediately after the correlation engine fires a rule?
Security Operations (CySA+) / Network Security (Security+)
7. An organization wants its SIEM to collect Windows Event Logs without installing software on every endpoint. Which collection method should they configure?
Governance, Risk and Compliance (Security+) / Security Operations (ISC2 CC)
8. A security analyst uses SIEM log data to investigate an incident. Which ethical obligation must the analyst observe when handling log data that contains employee personal information?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
Program planNext lesson →