QuestionQ50

VerifiedLog Management

Jannet is a SOC analyst at a multinational corporation that operates multiple data centers, cloud environments, and on-premises systems. She notices that security incidents are taking too long to detect and investigate. After analyzing the issue, she finds that logs from firewalls, endpoint security solutions, authentication servers, and cloud applications are distributed across different systems and use various formats; therefore, her team must manually convert the logs into a readable format before investigating incidents.

What approach should she implement to accept logs from heterogeneous sources in different formats, convert them into a common format, and improve incident detection and response time?

Explanation

Log normalization converts event records from diverse systems into a consistent common schema and format. This lets analysts and security tools interpret firewall, endpoint, authentication, and cloud-application logs consistently, reducing manual preparation and supporting faster detection and investigation.

Community Discussion

No comments yet. Be the first to start the discussion!