Library · practice
SIEM and security operations
Collect and read security logs, triage alerts, and write detections as code that catch real attacks without drowning analysts in noise.
SIEM and security operations appeared in 74% of the Cybersecurity Engineer job descriptions we read, and in 91% of the junior ones: most security careers start in a security operations centre.
The examples use a synthetic SSH log generated by a script in the first lesson, so you can reproduce every result. The attack in it uses addresses from the ranges reserved for documentation (RFC 5737), not real hosts. Detections are written in Sigma, the open rule format that converts to Splunk, Sentinel, Elastic and other SIEM query languages.
Intermediate lessons for SIEM and security operations are being written.
Advanced lessons for SIEM and security operations are being written.