Monitoring

SIEM and log correlation

Also called security information and event management, correlation rule, alert rule, threshold rule, sequence rule, log correlation

Gathering every device's log in one place, parsing each line into fields, and running rules across all of them to raise alerts.

A collector answers "what did this device log?"; a SIEM answers "what happened across the network?". It parses each incoming line into named fields (src, user, dport, host) and runs rules over the stream: a threshold (enough matching events in a window — ten refused ports is a scan), a count grouped by a field across hosts (five failed logins from one source, wherever they landed, is brute force), and a sequence (an accepted login from a source that just scanned and guessed). One alert per pattern replaces a flood of raw lines, and serious alerts drive a response through an API integration (a ticket, a page). An analyst reads dashboards and a query API rather than the raw files. Tune with an ignore list so a known scanner does not bury the alerts that matter.

See it on real machines

Learn it on real machines.