DevSecOps Practice Hub

SIEM & Security Analytics

Centralise security-relevant events and detect suspicious activity across the estate.

AdvancedSIEMOperations

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Operate Runtime security, secrets rotation and configuration reconciliation.
  • Monitor Detection engineering, SIEM, compliance evidence and incident response.

Overview

A SIEM ingests logs from cloud, clusters, CI and endpoints, normalises them and runs detection rules that correlate across sources.

Why it matters

Most intrusions are visible in logs the organisation already collects but never correlates.

How it works

  1. 01Sources are onboarded with a consistent schema.
  2. 02Detection rules and correlations produce alerts with context.
  3. 03Alerts feed the incident response process with defined severities.

Common tools

Elastic SecurityWazuhSplunkKubernetesAWSLinux

Implementation examples

textDetection query sketch
event.dataset: "aws.cloudtrail"  and event.action: "ConsoleLogin"  and aws.cloudtrail.response_elements.ConsoleLogin: "Success"  and not source.geo.country_iso_code: ("GB" or "DE")
Geography-based rules need an allow-list for travel and VPN egress or they generate constant noise.

Best practices

  • Onboard sources with a normalised schema.
  • Measure detection coverage against ATT&CK.
  • Review noisy rules monthly.

Common mistakes

  • Collecting everything with no detections written against it.