How to perform incident detection and examination with SIEM tools?

  • Basic security monitoring
  • Advanced threat detection
  • Forensics & incident response
  • Log collection
  • Normalization
  • Notifications and alerts
  • Security incident detection
  • Threat response workflow
  • Threat detection
  • Investigation
  • Time to respond
  1. Splunk: Splunk is a full on-prem SIEM solution that Gartner rates as a leader in the space. Splunk supports security monitoring and can provide advanced threat detection capabilities.
  2. IBM QRadar: QRadar is another popular SIEM that you can deploy as a hardware appliance, a virtual appliance, or a software appliance, depending on your organization’s needs and capacity.
  1. Data aggregation: bringing together massive volumes of data from several applications and databases in a single location.
  2. Data normalization: SIEM enables the comparison, correlation, and analysis of all heterogeneous data.
  3. Data analysis/correlation of security events: Identifying potential indicators of a data breach, threat, attack, or vulnerability.




CE|H v11 || CTF 🏳️ || Cybersecurity Researcher || Programmer 👨‍💻Founder of CyberJunk

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

{UPDATE} Грамотей 2 Школьникам Hack Free Resources Generator

Security Guidance Fit for a Pandemic

CLUBHOUSE? Maybe not! 违反在线隐私 — Clubhouse

Internet Privacy Policy for teens: What Parents should know

$FONT Private Sale Announcement

🎉We are glad to announce that we are now available on @CoinMarketCap

Google’s Replacement is Here

{UPDATE} Cute & Tiny Pets Hack Free Resources Generator

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Prasan singh

Prasan singh

CE|H v11 || CTF 🏳️ || Cybersecurity Researcher || Programmer 👨‍💻Founder of CyberJunk

More from Medium

SANS Holiday Hack Challenge 2021

How we discovered zero-day vulnerabilities in Riverbed Software Agent

For Those Who Think Microsoft Patching is Optional — Cynexlink

Port Knocking