SIEM Engineering

Purpose

Design and maintain SIEM infrastructure, onboard log sources, develop correlation rules, manage detection use cases, and tune for false positive reduction. This skill covers architecture decisions, ingestion pipeline design, correlation rule development, use case management, performance optimization, and cost control.

Agent Protocol

Trigger

• "SIEM", "Splunk", "Elastic Security", "Wazuh", "Microsoft Sentinel", "QRadar"
• "log source", "log onboarding", "syslog", "Windows Event Log", "log collector"
• "correlation rule", "detection rule", "SIEM use case", "use case management"
• "false positive", "SIEM tuning", "alert suppression", "SIEM optimization"
• "log retention", "SIEM architecture", "log ingestion", "index strategy"