The SIEM method

1 What happens inside

Every step can go wrong in a way that matters for evidence. A parser that reads a local time as UTC moves every event by an hour. A field called user can mean the account in one source and the display name in another. An event that failed to parse may be missing from searches entirely. Before you rely on a SIEM search, look at the raw lines behind a few results, and keep the original exports.

2 Search, pivot, timeline

1. Start from the trigger. Read the alert's raw events. Write down every entity it names: addresses, hosts, accounts, domains, times.
2. Pivot on each entity. Search each one across all sources, with a time window around the event. Every new entity you find (a MAC address, a second account, a domain) becomes the next pivot.
3. Widen the time. What did the same entities do in the days before and after? Preparation and follow-up are often more telling than the incident itself.
4. Build the timeline. One list, one time base, every entry with its source and how reliable it is.
5. Test hypotheses. For each explanation ask which events it predicts, then search for them. Look as hard for evidence against your favourite explanation as for evidence for it.
6. Document the searches you ran, with time range and result counts, so another examiner can repeat them.

3 A small SIEM to practise on

One invented day at an invented company: Windows logon events, a web proxy, a VPN gateway and a GeoIP table. The language is the same as in the case workbench: field=value, then commands after |, for example | stats count by user, | table _time user src_ip or | lookup geoip network AS src_ip. Times are UTC.

4 Alerts are hypotheses

An alert says that a rule matched, not that something bad happened. Triage means deciding quickly whether it is a true positive (the rule caught what it was meant to catch), a false positive (it matched something harmless), or needs investigation. Two habits help:

• Know the base rate. A rule that fires for every large upload will mostly catch backups and video calls. Check what the rule sees on normal days before you trust a single hit.
• Check the inputs. Many rules depend on enrichment data. "Impossible travel" compares GeoIP locations of two logins. But GeoIP databases record who registered an address range, not where the user stands. VPN exits, mobile carriers (CGNAT), satellite and corporate networks often geolocate hundreds of kilometres away; the accuracy radius and the organisation name tell you how far to trust a location.

5 Try it yourself

Answer with searches in the small SIEM above.