Engineering track

SIEM Engineering

Own the pipeline: onboard sources, normalise fields, keep ingestion healthy and data quality high.

Configured sources

Total EPS

21,820

Unhealthy sources

Parse failure rate

0.42%

Data source management

Source	Group	Type	EPS	Health
Windows Event Log	Endpoint	windows	1,840	Healthy
Sysmon	Endpoint	sysmon	2,410	Healthy
Linux Audit	Endpoint	linux_audit	430	Healthy
EDR	Endpoint	edr	690	Degraded
Firewall	Network	firewall	3,120	Healthy
IDS / IPS	Network	ids	210	Healthy
DNS	Network	dns	2,870	Healthy
Proxy	Network	proxy	1,560	Healthy
VPN	Network	vpn	120	Healthy
NetFlow	Network	netflow	4,300	Lagging
Active Directory	Identity	ad	980	No Data
Entra ID	Identity	entra	540	Healthy
Web Server	Application	web	1,330	Healthy
Database	Application	db	260	Healthy
Email Security Gateway	Email	email	310	Healthy
AWS CloudTrail	Cloud	aws	470	Healthy
Azure Activity	Cloud	azure	380	Healthy

Extract named fields from a raw event

Sample event

<134>Aug 29 09:12:44 fw-edge-01 SFW: allow src=10.20.14.61 dst=185.220.101.44 spt=51422 dpt=443 proto=TCP act=ALLOW bytes=8421