Log correlation: one event, many logs, a rule that joins them

The idea

A SIEM gathers every device's log in one place and runs rules across all of them: not "this one line is bad" but "these events, from these devices, in this order". Here the firewall, fileServer and webServer ship their logs to the siem, the attacker scans and guesses passwords, the laptop logs in honestly, and ticketing opens a ticket for the serious alert.

Steps

1. Every device's log in one file

   A rule can only join lines that sit in one place, so first follow one line there. A login on fileServer writes an sshd line to its own log; a shipper forwards it to the siem, which files it in one events.log beside every other device's lines. The siem's correlator names the rules it loaded.

   siem:~# grep -m1 'rules loaded' /var/log/siem/correlator.log
   siem:~# grep -m1 'fileServer sshd Accepted' /var/log/siem/events.log

2. A port scan the firewall refuses becomes one alert

   The attacker scans many ports on fileServer. The firewall allows SSH (22), rejects the rest and logs each refusal, so every refused packet reaches the siem as a firewall.reject event with its src and dport. Twenty such lines are noise; the port-scan rule turns them into one alert at ten distinct ports refused from one source in a minute.

   siem:~# grep -m1 port-scan /var/log/siem/alerts.log