Every system in an organisation keeps a running record of what happens on it, and those records are where most investigations begin. A single machine can produce thousands of log entries an hour, so no analyst reads them one by one. This module shows you what logs contain and how a SIEM brings them together so that the important events stand out.
You'll start with log data itself: what gets recorded and why it matters for security. Then you'll see what a SIEM is and how it collects and correlates logs from many sources, look at the key capabilities that SIEM platforms offer, and finish with Splunk, a widely used platform for searching and monitoring security data.
Once you're comfortable here, move on to Network Traffic Analysis to look at the activity that travels between systems rather than the records they keep.
How log files record data flows, firewall decisions, and other events, and why they are the starting point for investigating an incident.
An introduction to Security Information and Event Management, the earlier technologies it builds on, and why it is a core tool in a SOC.
The main things a SIEM platform does for a security team, from collecting and correlating logs to alerting and reporting.