Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
SIEM, the SOC and Event Correlation
From logs to incidents
Modern organisations produce billions of log entries. On their own they’re noise. A SIEM (security information and event management) system turns them into a searchable, correlated view, and a security operations centre (SOC) turns that view into decisions. Together they’re the core of the CISM topic “incident management tools and techniques”.
How a SIEM works
- Collect logs from many sources.
- Normalise them into a common format.
- Correlate related events.
- Alert analysts, with priorities.
- Investigate and report: search, timelines, compliance reports.
Time synchronisation (NTP) across systems is essential, or events can’t be lined up. Logs should be stored where administrators can’t alter them.
The SOC
- Tools: SIEM, SOAR and detection tools collect, correlate, enrich and automate.
- Tier 1: triage alerts, close false positives, escalate real ones.
- Tier 2: investigate escalated alerts, scope and contain.
- Incident response and threat hunting: major incidents, forensics, and proactively searching for hidden attackers.
SOAR automates routine steps such as enrichment and blocking known-bad indicators; humans make the high-impact decisions.
Decisions for the security manager
| Decision | Considerations |
|---|---|
| Build, buy or hybrid SOC | 24x7 needs, skills, cost, control |
| Log sources and retention | Coverage of critical assets; legal retention; cost |
| Use cases | Mapped to top risks and attacker techniques |
| Automation (SOAR) | Which steps to automate, and the guardrails |
| Metrics | Mean time to detect and respond, coverage, false positives |
Outsourcing the SOC to an MSSP or MDR provider is common, but accountability and business context stay with the organisation.
Correlation in action
Example. Individually, three events look normal: a VPN login from abroad, a new mailbox forwarding rule and a large download from the finance share. The SIEM correlates them within ten minutes as one account takeover, and the SOC disables the account before the data leaves.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Primary purpose of a SIEM | Collect and correlate events to detect incidents |
| Why time synchronisation matters | So events across systems can be correlated |
| Tool that automates response steps | SOAR |
| The SOC is outsourced; who is accountable? | The organisation |
| The SIEM produces too many alerts | Tune the use cases and reduce false positives |
In short
- A SIEM collects, normalises and correlates logs from many sources to detect incidents and support investigations.
- Correlation links events that look harmless alone, such as a foreign login followed by a large download.
- A security operations centre (SOC) monitors, triages and responds, often in tiers, with threat hunting and incident response above.
- SOAR automates routine steps; humans make the high-impact decisions.
- Options: in-house SOC, outsourced (MSSP/MDR) or hybrid; accountability stays with the organisation.
- Incident management tools and techniques are a named CISM topic: the manager decides coverage, staffing, tuning and metrics.
Exam traps
- A SIEM without tuning and people produces noise, not detection.
- Logs stored where administrators can change them aren't reliable evidence.
- Without time synchronisation, events from different systems can't be correlated.
- Outsourcing the SOC doesn't outsource accountability or business context.
Slides
Click the slide and use the arrow keys. F toggles full screen.
How a SIEM works
The SOC