Tutorial 1: Logging, SIEM, and Detection Engineering

Unit 7 ยท Monitoring and incident response

Objectives

Logs should answer who did what, to which resource, when, from where, and with what result. A SIEM correlates events across systems, but aggregation does not create meaning automatically. Normalize timestamps, identities, action names, resource identifiers, and outcome fields while excluding secrets and unnecessary personal data.

event: authorization_denied
actor: svc-report
resource: payroll-view
action: export
source: 10.0.4.8
result: denied
correlation_id: 7f2a...

Detection engineering turns threat hypotheses into queries, thresholds, context enrichment, ownership, and response. Measure precision, recall, time to detect, time to triage, and alert closure quality. Protect log integrity, retention, and access.

Exercises

  1. Define fields for an administrator access event.
  2. Write a detection for impossible travel or unusual export volume.
  3. Design a false-positive tuning review.

Self-check

  1. What makes a log useful?
  2. Why synchronize clocks?
  3. What is alert precision?

Self-Check Quiz

1. Should logs contain passwords?

AnswerNo. Secrets must never be logged; sensitive data should be minimized and access-controlled.

2. What does correlation add?

AnswerIt connects related events across systems and provides context for investigating a hypothesis.

Homework

  1. Design a telemetry schema for a privileged-access system.
  2. Create three detections with evidence and response.
  3. Define measures for detection health.
Sample answerEvents include timestamp, actor, identity source, action, target, source, result, correlation id, and reason, without secrets. A detection specifies query, baseline, confidence, owner, escalation, and retention. Measure false-positive rate, coverage, MTTD, and MTTR.