siem-logging

What problem does it solve?

This Skill helps you establish a robust Security Information and Event Management (SIEM) system to centralize security logs, enabling effective threat detection, incident investigation, and compliance.

Core Features & Use Cases

• SIEM Platform Selection: Provides a decision framework for choosing between Elastic SIEM, Microsoft Sentinel, Wazuh, and Splunk based on budget, infrastructure, and expertise.
• Detection Rule Development: Guides the creation of universal SIGMA rules and platform-specific queries (EQL, KQL, SPL) for threat detection.
• Log Aggregation Architecture: Details centralized, distributed, and cloud-native architectures for collecting logs.
• Compliance & Retention: Outlines log retention policies to meet GDPR, HIPAA, PCI DSS, and SOC 2 requirements.
• Alert Tuning: Strategies for reducing false positives and optimizing alert quality.
• Use Case: Implement a SIEM solution to monitor for brute-force attacks, detect privilege escalation, and ensure audit trails for compliance.

Quick Start

Use the siem-logging skill to configure Microsoft Sentinel for Azure AD log ingestion.