SIEM

SIEM — turli tizimlardan security log va eventlarni markaziy yig‘ish, normalizatsiya qilish, qidirish, correlation va alert yaratish uchun ishlatiladigan platforma. To‘liq nomi Security Information and Event Management.

SIEM endpoint, server, application, identity, firewall, cloud va boshqa manbalardagi signallarni bir timeline’da birlashtirib security monitoring va incident investigationga yordam beradi.

Log manbalari

SIEM quyidagilardan ma’lumot olishi mumkin:

Har manba uchun owner va ingestion health kuzatiladi.

Collection

Loglar:

agent;
syslog;
API;
message broker;
cloud connector;
file collector;
event streaming

orqali olinadi.

Collector buffer va retry bilan source uzilib qolganida data yo‘qolishini kamaytiradi.

Parsing

Raw log ichidan fieldlar ajratiladi:

timestamp;
user;
source IP;
destination;
action;
status;
resource;
event ID;
device;
severity.

Parser noto‘g‘ri bo‘lsa correlation va search sifati pasayadi.

Normalization

Turli vendor bir tushunchani boshqa nom bilan yozishi mumkin.

Masalan:

src_ip
sourceAddress
client_ip

Normalization ularni umumiy schema’ga map qiladi.

Original raw event ham forensic uchun saqlanishi mumkin.

Enrichment

Event qo‘shimcha kontekst bilan boyitiladi:

asset criticality;
user department;
IP reputation;
geolocation;
vulnerability;
hostname;
tenant;
threat intelligence;
device owner.

Enrichment alert prioritetini aniqroq qiladi.

Correlation

Bitta event oddiy bo‘lishi mumkin, ammo ketma-ketlik shubhali.

Masalan:

ko‘p failed login
→ successful login
→ admin role assignment
→ katta data export

Correlation rule bir nechta source va vaqt oralig‘ini birlashtiradi.

Detection rule

Rule ma’lum threat yoki behaviorni aniqlaydi.

Turlari:

threshold;
sequence;
anomaly;
indicator match;
impossible travel;
rare event;
privileged action;
policy violation.

Har rule owner, version va testga ega bo‘ladi.

Alert

Rule shartlari bajarilganda alert yaratiladi.

Alert:

evidence;
affected asset;
user;
severity;
reason;
timeline;
recommended triage

ma’lumotini beradi.

Ko‘p kontekstsiz alert analyst uchun shovqin yaratadi.

False positive

Qonuniy maintenance, scanner yoki yangi deployment rule’ni ishga tushirishi mumkin.

Tuning:

allowlist;
threshold;
context;
time window;
asset scope;
user group

orqali bajariladi.

Rule’ni butunlay o‘chirishdan oldin sabab tahlil qilinadi.

False negative

Rule mavjud bo‘lsa ham attacker aniqlanmasligi mumkin.

Sabablar:

log kelmayapti;
parser buzilgan;
visibility yo‘q;
query noto‘g‘ri;
attacker boshqa usul;
retention yetarli emas.

Detection coverage threat model bilan tekshiriladi.

Use case

SIEM use case ma’lum riskni kuzatish uchun log, rule va response jarayonini birlashtiradi.

Masalan:

privileged login;
impossible travel;
malware C2;
data exfiltration;
account lockout;
firewall change;
cloud public access.

Use case’ning business maqsadi aniq bo‘ladi.

Dashboard

Dashboard:

alert trend;
top source;
login anomaly;
asset coverage;
ingestion delay;
rule health;
incident status

ni ko‘rsatishi mumkin.

Dashboard real-time response o‘rnini bosmaydi.

Retention

Loglar ma’lum muddat hot, warm va archive storage’da saqlanadi.

Retentionga:

incident investigation;
legal talab;
storage narxi;
privacy;
source hajmi

ta’sir qiladi.

Critical audit loglar immutable storage’da saqlanishi mumkin.

Time

Barcha source’lar sinxron vaqt va timezone bilan log yozishi kerak.

Clock skew event tartibini buzadi.

SIEM ingestion time va event time’ni alohida saqlashi mumkin.

Access control

SIEM juda ko‘p sensitive data saqlaydi.

Analyst accessi:

role;
tenant;
data source;
search;
export;
administration

bo‘yicha cheklanadi.

Query va export audit qilinadi.

SIEM va SOAR

SIEM eventlarni yig‘adi, correlation va alert yaratadi.

SOAR alertni enrichment, ticket, playbook va response operationlari bilan avtomatlashtiradi.

Ko‘p platformalarda funksiyalar qisman birlashishi mumkin.

SIEM va EDR

EDR endpoint telemetry va response’ga yo‘naltirilgan.

SIEM esa ko‘p turdagi manbalarni markaziy birlashtiradi.

EDR alert va eventlari SIEMga yuborilib identity va network loglari bilan correlation qilinadi.

Ingestion health

Log source jim qolishi “xavfsizlik hodisasi yo‘q” degani emas. Collector heartbeat, oxirgi event va kutilgan volume kuzatiladi. Domain controller yoki firewall logi to‘satdan to‘xtasa alohida alert yaratiladi.

Detection engineering

Rule yaratish jarayoni threat hypothesis, kerakli telemetry, test data, tuning va response’dan iborat. Rule nomi va queryning o‘zi yetarli emas. Detection qaysi attacker technique’ni qamrab olishi va qaysi visibility gap mavjudligi hujjatlashtiriladi.

Cost

SIEM narxi ko‘pincha event hajmi, storage va compute’ga bog‘liq. Keraksiz debug logni cheksiz ingest qilish qimmat, lekin security uchun zarur fieldni filtrlash detectionni buzadi. Source bo‘yicha qiymat va volume muvozanati qilinadi.

Data quality

Timestamp, user ID, action va result fieldlari to‘liq bo‘lmasa yaxshi correlation qurib bo‘lmaydi. Application logging standardi SIEM talablarini development bosqichida hisobga oladi. Sensitive payload to‘liq log qilinmaydi.

SOC workflow

Alert SIEMda yaratilgach triage, evidence yig‘ish, classification va escalation bosqichlaridan o‘tadi. Rule severitysi incident severitysi bilan aynan bir xil bo‘lmasligi mumkin. Analyst asset va business kontekst asosida yakuniy prioritetni belgilaydi.

Search

Incident paytida analyst historical loglar bo‘yicha ad-hoc query bajaradi. Field naming, index va retention qidiruv tezligiga ta’sir qiladi. Saved search va notebookga o‘xshash hujjat investigationni takrorlashga yordam beradi.

Bog‘liq tushunchalar

Security Information and Event Management, Log management, Correlation, Detection rule, Alert, Event normalization, Threat intelligence, SOC, SOAR, EDR