Quick answer: A SIEM (security information and event management) system collects logs from computers, servers, cloud services and network devices, searches them for suspicious patterns and raises alerts. SOC analysts use it every day to investigate alerts and respond to incidents. Splunk, Microsoft Sentinel and Wazuh are three widely used options.
What a SIEM does
- Collects logs from many sources in one place
- Normalises them so different log formats can be searched together
- Detects suspicious activity using rules (detections)
- Alerts analysts and helps them investigate
- Reports on incidents and trends
Splunk, Sentinel and Wazuh
| Splunk | Microsoft Sentinel | Wazuh | |
|---|---|---|---|
| Type | Commercial platform | Cloud-native SIEM in Microsoft Azure | Open-source security platform |
| Known for | Powerful search across large log volumes | Integration with Microsoft and Azure services | Free to run; good for labs and smaller setups |
| Good for learning | Search queries and dashboards | Cloud and Microsoft security | Building your own home SOC lab |
How analysts use MITRE ATT&CK with a SIEM
MITRE ATT&CK is a public knowledge base of attacker techniques. Analysts map alerts to these techniques to understand what an attacker is trying to do and to write better detections.
Practise in a real SOC setting
Our Cybersecurity – SOC Analyst & Cloud Security course covers SIEM with Splunk, Sentinel and Wazuh, log analysis, MITRE ATT&CK, incident response and detection writing, with a home SOC lab and simulated SOC shifts. It runs for 4.5 months with a 2-month internship and is aligned to Security+, Splunk and SC-200 (exams booked separately). Read Is cybersecurity a good career choice?.
Frequently asked questions
Is SIEM only for large companies?
No. Open-source tools such as Wazuh make it possible to run a SIEM in smaller environments and in a home lab.
What is a detection?
A rule that looks for a specific suspicious pattern in logs and raises an alert when it finds it.
Which certification covers Microsoft Sentinel?
Microsoft SC-200 focuses on security operations with Microsoft tools including Sentinel.
Not sure yet? Talk to us
Book a free demo class or ask for 1:1 guidance on WhatsApp at +91 99020 58603, or use the form on our contact page. You can also compare all our courses and our combo courses. Scholar’sEdge Academy is at Building No. 19, 25/1, 9th Cross Road, 2nd Phase, J. P. Nagar, Bengaluru, Karnataka 560078.
