4 — SIEM: normalisation and correlation

4 — SIEM: normalisation and correlation

Study time: ± 60 minutes

What a SIEM does

Individual sensors each see a sliver of what happens. A SIEM is the control room where all those feeds come together on one wall of screens: it collects logs and alerts from across the whole network, brings them to one place and one format, connects the dots, and raises alerts a human can act on. In the MAPE-K loop it sits at Plan — where a mass of raw events becomes a manageable set of decisions.

Normalisation: one common language

Sensors come from many vendors and "speak different languages". Before you can compare them, a SIEM normalises them into a common form, conceptually across three layers:

• Schema — what the fields mean.
• Encoding — how they are written down (text like Syslog, JSON, XML; or binary).
• Transport — the protocol that moves them from sensor to SIEM.

You will meet a few formats in practice: Syslog as the widespread default, and vendor formats like CEF and LEEF that became de-facto standards through the tools that use them. The point is why normalisation exists: without it, a firewall log and a web-server log cannot be read side by side.

Correlation: finding meaning

Consolidating data is step one; the value is in correlation — combining separate events into one meaningful signal. This is the direct answer to the base-rate fallacy: correlation filters the noise. CyBOK's four kinds:

1. Between alerts — many alerts that are really one phenomenon (a worm spreading).
2. With the environment — is this alert even relevant to the target's OS and services?
3. With external sources — threat intelligence about attacker paths and motives.
4. Incident exchange — information shared by CERTs and ISACs about threats in your sector.

Through these, a SIEM turns raw events into alerts, and groups of alerts into incidents that need human attention.

Core resources

• What is SIEM? (IBM Technology) — a clear plain-language overview with a short explainer video. (± 20 min)
• Elastic (ELK) stack — ingest logs and build queries/dashboards; feel what a SIEM does. (± 25 min)
• Splunk — a widely used commercial SIEM, useful to compare with the open ELK approach.
• CyBOK KA 8, section 4 (SIEM) — collection, normalisation, correlation.

Check yourself

1. Why does a SIEM need to normalise data before it can correlate?
2. Name the four kinds of correlation and give an example of one.
3. Explain the chain: event → alert → incident.
4. Why is time synchronisation across sources essential for a SIEM?