Cyberstudy
PDF p.325 In progress

Security Information and Event Management

Open PDF at p.325 13 flashcards

Summary

PDF p.325

Security Information and Event Management (SIEM) software helps manage security data inputs, providing reporting and alerting by collecting and correlating data from various sources like network sensors, appliance/host/application logs, and more.

In plain words

Supplementary — not from your PDF

A SIEM collects and correlates security data from across the environment. Collection can be agent-based (hosts filter and normalize, then forward), listener/collector (devices push logs, for example by syslog), or sensor-based (packet and flow data from taps or mirror ports). Aggregation and normalization convert vendor formats and time zones into one consistent, searchable timeline.

Detailed explanation

PDF p.325

Core Function

  • Data Collection and Correlation: From network sensors, appliance/host/application logs, including Windows and Linux hosts, switches, routers, firewalls, IDS sensors, packet sniffers, vulnerability scanners, malware scanners, and DLP systems.

Types of Security Data Collection

  • 1. Agent-Based Collection
    • Description: Installing an agent service on each host.
    • Process: Filters, aggregates, and normalizes logging data at the host, then sends it to the SIEM server.
    • Usage: Common for Windows/Linux/macOS computers.
    • Resource Use: 50–500 MB of RAM, depending on activity.
  • 2. Listener/Collector
    • Description: Hosts push log changes to the SIEM server.
    • Process: Management server parses and normalizes each log/monitoring source.
    • Usage: Common for switches, routers, and firewalls using Syslog protocol.
  • 3. Sensor-Based Collection
    • Description: Collects packet captures and traffic flow data from sniffers.
    • Process: Uses mirror port functionality of a switch or network tap.

Log Aggregation

  • Purpose: Normalizes data from different sources to make it consistent and searchable.
  • Tools: SIEM software features connectors or plug-ins to interpret data from various systems.
  • Normalization: Accounts for vendor implementation differences and normalizes date/time zone differences to a single timeline.

Important terms

taken from the text above
Data Collection and Correlation
From network sensors, appliance/host/application logs, including Windows and Linux hosts, switches, routers, firewalls, IDS sensors, packet sniffers, vulnerability scanners, malware scanners, and DLP systems.
Agent-Based Collection
Installing an agent service on each host.
Resource Use
50–500 MB of RAM, depending on activity.
Listener/Collector
Hosts push log changes to the SIEM server.
Sensor-Based Collection
Collects packet captures and traffic flow data from sniffers.
Normalization
Accounts for vendor implementation differences and normalizes date/time zone differences to a single timeline.
SIEM Security Information and Event Management

Examples & real-world scenarios

Supplementary — not from your PDF
  • Windows agents forwarding normalized events.
  • Firewalls sending syslog to a collector.
  • A sensor on a SPAN port feeding flow data.

Scenario

Firewall logs use local time and server logs use UTC, so correlation rules miss connections. SIEM normalization aligns timestamps onto one timeline.

Common mistakes

Supplementary — not from your PDF
  • Assuming all devices can run agents. Network gear usually uses syslog.
  • Skipping normalization, which makes correlation unreliable.

Practical skills

Supplementary — not from your PDF
  • Pick a collection method for each device type.

What I should remember

Key Points PDF p.325
  • Core Function: Data collection and correlation.
  • Types of Collection
    • Agent-Based: Host-installed agents.
    • Listener/Collector: Hosts push logs to SIEM.
    • Sensor-Based: Packet captures and traffic flow data.
  • Log Aggregation
    • Purpose: Consistent and searchable data.
    • Tools: Connectors or plug-ins.
    • Normalization: Vendor differences and time zones.