What is a SIEM and how does a SOC analyst use it?

What the interviewer wants to hear

• Collects and normalises logs from many sources
• Correlates events and raises alerts using rules
• Lets analysts search and investigate across data
• Supports retention, compliance and dashboards

Model answer

A SIEM, or Security Information and Event Management system, collects logs from many sources such as firewalls, Windows servers, EDR, cloud platforms and email gateways. It normalises them into a common format so they can be searched together. Correlation rules look for suspicious patterns, for example many failed logons followed by a success, and create alerts. As an analyst, I use the SIEM to triage alerts, run queries in languages like SPL or KQL to build a timeline, and pivot between users, hosts and IPs. It also stores logs for months, which helps investigations and compliance. Examples are Splunk, Microsoft Sentinel and Elastic. Many teams pair it with a SOAR tool to automate repeated steps like enrichment.

More easy Cybersecurity Analyst questions

• Explain the CIA triad and give a real example of an attack on each part.
• A user reports a suspicious email. How would you analyse it?
• What is the difference between a firewall, an IDS and an IPS?
• Explain the difference between hashing, encryption and encoding.
• What is defence in depth, and how would you explain it with a real example?
• What is MFA, and why are some MFA methods stronger than others?
• Explain false positives and false negatives in a SOC. Which is worse, and how do you balance them?
• What is the difference between a vulnerability scan and a penetration test?
• What is the principle of least privilege, and how would you apply it in an organisation?