Homebrew SIEM
How to build meaningful security monitoring without a SIEM product, and how to reason about what to watch.
Concepts
Meaningful security monitoring without a SIEM product, and how to reason about what to watch. Thi...
Architecture
The whole system is four stages in a line: collect, centralize, analyze, alert. Every later page ...
Collection
Pattern: getting logs off every host and into one place. This is the plumbing, getting this stage...
What to Monitor
Pattern: deciding what is worth watching. This is the judgment page, and it is deliberately gener...
Analysis
Pattern: turning collected logs into signals. Collection gathers raw logs, analysis reduces them ...
Alerting and Scheduling
Pattern: getting signals to a human, on a cadence. Analysis produces signals, this stage runs the...
Operations
A monitoring system that is installed and never tended decays into either noise you ignore or sil...
Lessons Learned
The lessons I've learned from building basic security monitoring without a SIEM product. You don'...