Principles of Information Security: Security Monitoring (SIEM, Log Analysis, Alerting)

Security Monitoring (SIEM, Log Analysis, Alerting)

Security Monitoring (SIEM, Log Analysis, Alerting) – Exam-Ready Study Guide

What This Is

Security monitoring is the continuous, real-time collection, analysis, and alerting of security-related data (logs, network traffic, user behavior) to detect and respond to threats before they cause damage. It’s the "eyes and ears" of cybersecurity—without it, attackers can dwell undetected for months (e.g., the 2017 Equifax breach, where unpatched software and poor monitoring allowed hackers to exfiltrate 147 million records over 76 days). Effective monitoring combines SIEM tools, log analysis, and automated alerting to stop incidents like ransomware (e.g., WannaCry), insider threats, or misconfigured cloud storage (e.g., AWS S3 buckets leaking PII).

Key Terms & Concepts

• SIEM (Security Information and Event Management):
  A centralized platform that aggregates, correlates, and analyzes logs from firewalls, endpoints, servers, and applications to detect anomalies (e.g., Splunk, IBM QRadar, Microsoft Sentinel). Follows NIST SP 800-92 (log management guidelines).

• Log Sources:
  Devices/systems that generate security-relevant data:

• Network logs (firewalls, IDS/IPS, routers – e.g., Cisco ASA, Palo Alto).
• Endpoint logs (Windows Event Logs, Sysmon, EDR tools like CrowdStrike).
• Application logs (web servers, databases – e.g., Apache, SQL Server).

• Cloud logs (AWS CloudTrail, Azure Monitor, GCP Audit Logs).

• Log Analysis:
  The process of parsing, filtering, and interpreting logs to identify malicious activity. Techniques:

• Signature-based detection (matching known attack patterns, e.g., Snort rules).
• Anomaly-based detection (baselining "normal" behavior, flagging deviations – e.g., UEBA).

• Correlation rules (linking events across systems, e.g., "failed login + unusual data transfer = brute force").

• Alerting:
  Automated notifications triggered by predefined rules (e.g., "10 failed SSH logins in 1 minute") or machine learning models. Alerts should be prioritized (e.g., MITRE ATT&CK tactics like "Lateral Movement") and tuned to reduce false positives.

• False Positive vs. False Negative:

• False Positive: A benign event flagged as malicious (e.g., an admin legitimately accessing a server at 3 AM).
• False Negative: A real attack missed by monitoring (e.g., zero-day exploit bypassing signatures).

• Goal: Balance detection (minimize false negatives) with efficiency (reduce false positives).

• UEBA (User and Entity Behavior Analytics):
  Uses AI/ML to detect unusual behavior (e.g., a user accessing 10x more files than usual). Part of NIST SP 800-53 (AC-2, AU-12) and ISO 27001 (A.12.4).

• MITRE ATT&CK Framework:
  A knowledge base of adversary tactics/techniques (e.g., "T1059 – Command-Line Interface") used to map alerts to attack stages (e.g., "Initial Access → Persistence → Exfiltration").

• SOAR (Security Orchestration, Automation, and Response):
  Extends SIEM by automating responses (e.g., isolating an infected host, blocking an IP via firewall). Tools: Palo Alto Cortex XSOAR, Splunk Phantom.

• Retention & Compliance:
  Logs must be stored for forensic investigations and regulatory compliance (e.g., GDPR – 1 year, HIPAA – 6 years, PCI DSS – 1 year). Use WORM storage (Write Once, Read Many) to prevent tampering.

• Syslog (RFC 5424):
  A standard protocol for sending logs to a central server (UDP port 514, TCP 6514 for encrypted syslog). Used by Linux (rsyslog), Windows (via NXLog), and network devices.

• Baselining:
  Establishing normal behavior (e.g., "average login times," "typical data transfer volumes") to detect anomalies. Required by NIST SP 800-61 (Incident Handling Guide).

Step-by-Step / Process Flow

1. Define Monitoring Scope & Objectives

• What to monitor? Prioritize critical assets (e.g., databases, domain controllers, cloud storage) and high-risk events (e.g., privilege escalation, data exfiltration).
• Compliance requirements: Map to NIST CSF (DE.CM – Detection Processes) or ISO 27001 (A.12.4).
• Example: "Monitor all AWS S3 bucket access for unauthorized downloads (PCI DSS Requirement 10)."

2. Deploy Log Sources & SIEM

• Configure logging on all devices (enable Windows Event Forwarding, Linux auditd, AWS CloudTrail).
• Forward logs to SIEM (e.g., Splunk Universal Forwarder, Fluentd for cloud logs).
• Normalize data (convert logs to a common format, e.g., CEF – Common Event Format).

3. Create Detection Rules & Alerts

• Signature-based rules: Use Snort/Suricata for network attacks, Sigma rules for SIEM queries.
  • Example: alert tcp any any -> $HOME_NET 3389 (msg:"RDP Brute Force"; threshold:type threshold, track by_src, count 5, seconds 60;)
• Anomaly-based rules: Set thresholds (e.g., "flag if a user downloads >1GB in 1 hour").
• MITRE ATT&CK mapping: Tag alerts with tactics (e.g., "T1078 – Valid Accounts").
• Tune alerts: Adjust sensitivity to reduce false positives (e.g., whitelist IT admin IPs).

4. Investigate & Triage Alerts

• Prioritize alerts using risk scoring (e.g., "Critical" for ransomware, "Low" for failed login).
• Correlate events: Check if an alert is part of a larger attack (e.g., "failed login → RDP connection → data exfiltration").
• Use playbooks: Follow NIST SP 800-61 (Incident Response) or SANS IR steps (Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned).

5. Automate Response (SOAR)

• Isolate infected hosts (e.g., trigger EDR quarantine via API).
• Block malicious IPs (e.g., update firewall rules via Palo Alto Panorama).
• Enrich alerts (e.g., query VirusTotal for file hashes, Shodan for IP reputation).

6. Continuous Improvement

• Review false positives/negatives weekly (e.g., "Why did we miss the phishing email?").
• Update rules based on new threats (e.g., CISA Known Exploited Vulnerabilities).
• Test detection with red team exercises or purple teaming.

Common Mistakes

Certification Exam Tips

CISSP

• Management vs. Technical: CISSP focuses on strategy (e.g., "How would you design a monitoring program for a global enterprise?") rather than tool-specific details.
• Key Concepts: Know NIST SP 800-92 (log management), ISO 27001 A.12.4 (monitoring), and MITRE ATT&CK (tactics/techniques).
• Tricky Question: "Which is the most effective way to reduce false positives in a SIEM?"
• Answer: Tune correlation rules (not "buy more hardware" or "ignore alerts").

Security+

• Tool-Specific Questions: Know SIEM tools (Splunk, QRadar) and log sources (firewalls, EDR, cloud).
• Scenario-Based: "A SOC analyst sees 100 failed login attempts from the same IP. What’s the next step?"
• Answer: Investigate for brute force attack (not "block the IP immediately" – could be a false positive).
• Ports/Protocols: Memorize Syslog (UDP 514, TCP 6514) and NetFlow (UDP 2055).

CEH

• Attacker Perspective: CEH asks, "How would an attacker bypass monitoring?"
• Answers: Log tampering (deleting logs), living off the land (using built-in tools like PowerShell), slow attacks (avoiding thresholds).
• Detection Evasion: Know MITRE ATT&CK techniques (e.g., "T1070 – Indicator Removal on Host").

Quick Check Questions

1. A SOC analyst receives an alert for "10 failed SSH logins in 1 minute from an external IP." What is the most appropriate next step?

• A) Immediately block the IP at the firewall.
• B) Investigate if this is part of a brute force attack and check for successful logins.
• C) Ignore the alert as it’s likely a false positive.
• D) Reboot the server to stop the attack.

Answer: B
Explanation: Always investigate before blocking to avoid false positives (e.g., a legitimate admin mistyping a password).

2. Which of the following is the primary purpose of a SIEM in a security operations center (SOC)?

• A) Encrypting all network traffic.
• B) Aggregating and correlating logs to detect security incidents.
• C) Automatically patching vulnerabilities.
• D) Generating compliance reports for auditors.

Answer: B
Explanation: SIEMs collect, correlate, and analyze logs to detect threats (e.g., Splunk, QRadar). Encryption (A) and patching (C) are separate functions.

3. During a ransomware attack, the SOC notices unusual data transfers to an external IP. Which MITRE ATT&CK tactic does this align with?

• A) Initial Access
• B) Persistence
• C) Exfiltration
• D) Lateral Movement

Answer: C
Explanation: Exfiltration (TA0010) involves stealing data (e.g., sending files to an attacker’s server).

Last-Minute Cram Sheet

1. SIEM = Security Information and Event Management (Splunk, QRadar, Sentinel).
2. Syslog = UDP 514 (unencrypted), TCP 6514 (TLS).
3. False Positive = Benign event flagged as malicious (e.g., admin login at 3 AM).
4. False Negative = Real attack missed (e.g., zero-day exploit).
5. MITRE ATT&CK = Framework for adversary tactics/techniques (e.g., "T1059 – Command-Line Interface").
6. UEBA = User and Entity Behavior Analytics (AI/ML for anomaly detection).
7. SOAR = Security Orchestration, Automation, Response (e.g., Cortex XSOAR).
8. Log Retention: HIPAA = 6 years, PCI DSS = 1 year, GDPR = 1 year.
9. WORM Storage = Write Once, Read Many (prevents log tampering).
10. ⚠️ Exam Trap: "SIEM eliminates all false positives" → False (requires tuning!).

Final Tip: For exams, memorize the process (Scope → Deploy → Detect → Investigate → Respond → Improve) and key standards (NIST, ISO, MITRE). In the real world, tuning and correlation are everything!