2025-02-13
SIEM (Security Information and Event Management) is a critical component in modern cybersecurity, especially within Security Operations Centers (SOCs). It enables teams to monitor, detect, and respond to security threats by aggregating data from multiple sources and using advanced analytics to identify potential incidents. Below is a curated list of free SIEM training resources to help you dive deep into this essential cybersecurity tool.
General SIEM Resources
- Windows Logging Basics: https://lnkd.in/grKYFQzJ
- What is a SIEM? (5 Videos): https://lnkd.in/gc2UDpeD
- PowerSIEM Analyzing Sysmon Events with PowerShell: https://lnkd.in/g_8Eq8vm
QRadar
- QRadar (38 Videos): https://lnkd.in/gd7V_4pe
- QRadar 101: https://lnkd.in/esbz2RjK
- QRadar SIEM Foundation: https://lnkd.in/es8NAdAw
- Ariel Query Language Guide: https://lnkd.in/eAMKy25q
Splunk
- Course Catalog: https://lnkd.in/ekm6RekE
- Basic Searching: https://lnkd.in/gygnTMfD
- Practical Splunk – Zero to Hero: https://lnkd.in/ePF_3PWj
- Splunk Use Cases: https://lnkd.in/eJ4CTNV2
- Exploring Splunk: https://lnkd.in/e8gVvMuu
Microsoft Sentinel
- What is Microsoft Sentinel: https://lnkd.in/gdB7dAdU
- Microsoft Sentinel Level 400 Training: https://lnkd.in/ezDkpWmx
- SOC 101: https://lnkd.in/evnF6kNm
FortiSIEM
- FortiSIEM Training: https://lnkd.in/e5TvYZYt
AlienVault OSSIM
- Cybrary – AlienVault OSSIM: https://lnkd.in/gRZAansT
Elastic SIEM
- Fundamentals: https://lnkd.in/gYNYs9vS
- Manual: https://lnkd.in/dTVwgSbH
ArcSight
- What is Series: https://lnkd.in/gh5ruPZt
- ArcSight ESM 101: https://lnkd.in/gS33AJdk
- ArcSight Tutorial: https://lnkd.in/guEydy_U
SureLogSIEM
- Training (English): https://lnkd.in/eAnAYDWJ
- Training (Turkish): https://lnkd.in/e9VgJFHa
- Training PDF: https://lnkd.in/eXYFmqqV
- User Guide PDF: https://lnkd.in/e4HqkexW
LogSign
- Training: https://lnkd.in/eXnjymv6
What Undercode Say
SIEM tools are indispensable in today’s cybersecurity landscape. They provide a centralized platform for monitoring and analyzing security events across an organization’s IT infrastructure. By leveraging SIEM, SOC teams can efficiently detect and respond to threats, ensuring the security of sensitive data and systems.
To get hands-on experience, here are some practical commands and codes you can use:
1. Windows Logging with PowerShell:
Get-EventLog -LogName Security -Newest 10
This command retrieves the latest 10 security events from the Windows Event Log.
2. Splunk Search Query:
[spl]
index=main sourcetype=access_* status=200 | stats count by src_ip
[/spl]
This query counts successful HTTP requests (status 200) grouped by source IP.
3. Elastic SIEM Rule Creation:
{
"rule_id": "rule-001",
"description": "Detect multiple failed login attempts",
"index": ["auditbeat-*"],
"query": "event.action:login_failure",
"threshold": {
"value": 5,
"cardinality": "src_ip"
}
}
This JSON snippet creates a rule to detect multiple failed login attempts from the same IP.
4. QRadar AQL Query:
SELECT * FROM events WHERE LOGSOURCENAME(logsourceid)='Firewall' AND destinationport=22
This query retrieves all events from a firewall where the destination port is 22 (SSH).
5. Linux Log Analysis with Grep:
grep "Failed password" /var/log/auth.log
This command searches for failed password attempts in the Linux auth log.
6. Microsoft Sentinel KQL Query:
[kql]
SecurityEvent
| where EventID == 4625
| summarize count() by Account
[/kql]
This Kusto Query Language (KQL) query counts failed login attempts by account in Microsoft Sentinel.
By mastering these commands and tools, you can significantly enhance your ability to monitor and secure your environment. SIEM is not just a tool but a mindset that requires continuous learning and adaptation to new threats. The resources provided above will help you build a strong foundation and stay ahead in the ever-evolving field of cybersecurity.
For further reading and advanced techniques, consider exploring the official documentation and community forums of the SIEM tools you are using. Stay vigilant, keep learning, and always be prepared to defend against the next cyber threat.
Source: https://lnkd.in/gvgy8aUc
Credit: Harun Seker, CISSP
References:
Hackers Feeds, Undercode AI
