Engineering track
SIEM Engineering
Own the pipeline: onboard sources, normalise fields, keep ingestion healthy and data quality high.
Configured sources
17
Total EPS
21,820
Unhealthy sources
3
Parse failure rate
0.42%
Data source management
| Source | Group | Type | EPS | Health |
|---|---|---|---|---|
| Windows Event Log | Endpoint | windows | 1,840 | Healthy |
| Sysmon | Endpoint | sysmon | 2,410 | Healthy |
| Linux Audit | Endpoint | linux_audit | 430 | Healthy |
| EDR | Endpoint | edr | 690 | Degraded |
| Firewall | Network | firewall | 3,120 | Healthy |
| IDS / IPS | Network | ids | 210 | Healthy |
| DNS | Network | dns | 2,870 | Healthy |
| Proxy | Network | proxy | 1,560 | Healthy |
| VPN | Network | vpn | 120 | Healthy |
| NetFlow | Network | netflow | 4,300 | Lagging |
| Active Directory | Identity | ad | 980 | No Data |
| Entra ID | Identity | entra | 540 | Healthy |
| Web Server | Application | web | 1,330 | Healthy |
| Database | Application | db | 260 | Healthy |
| Email Security Gateway | 310 | Healthy | ||
| AWS CloudTrail | Cloud | aws | 470 | Healthy |
| Azure Activity | Cloud | azure | 380 | Healthy |
Parser lab
Extract named fields from a raw event
Sample event
<134>Aug 29 09:12:44 fw-edge-01 SFW: allow src=10.20.14.61 dst=185.220.101.44 spt=51422 dpt=443 proto=TCP act=ALLOW bytes=8421
Log onboarding checklist
- 1.Identify source, format and transport
- 2.Confirm time zone and timestamp format
- 3.Build and validate the parser
- 4.Map to the normalised schema (ECS-like)
- 5.Validate field coverage against detections
- 6.Enable and monitor for 24h
Data quality
- Missing host.name1.8%
- Unparsed events0.42%
- Clock skew > 60s3 sources
- Silent sources (24h)Active Directory
Learn this capability
Hands-on labs that build the technique behind this workspace. Skills transfer to any mainstream SIEM.
Intermediate · Theory · 18 min
SIEM architecture overview
You keep the SIEM healthy. Everything analysts do depends on data arriving, parsing correctly and being searchable.
Intermediate · Guided Lab · 35 min
Parser lab: custom firewall format
A new firewall model sends a proprietary log format. Until you parse it, none of its data is searchable or detectable.
Intermediate · Simulation · 25 min
Diagnosing a silent log source
The domain controller source has sent no events for two hours. Detection coverage for authentication is effectively off.