Security Operations · Topic 4 of 10
SIEM and EDR Tools
How SIEM correlation and EDR endpoint telemetry help analysts find and contain malicious activity, with alert tuning and a worked log reading example.
- 5 min
- Includes a diagram
- A SIEM collects, normalises, correlates, alerts and retains logs.
- Normalisation turns different log formats into common fields.
- Correlation links events across sources and over time.
What it is
A Security Information and Event Management (SIEM) platform collects logs from many sources, normalises them, correlates events and raises alerts. An Endpoint Detection and Response (EDR) tool runs an agent on each endpoint, records detailed activity and lets the analyst respond on that machine.
They answer different questions. The SIEM sees the whole environment from a distance, and the EDR sees one device in depth.
How it works
What a SIEM does
- Collects logs from firewalls, servers, identity systems, cloud services and more.
- Normalises them, which means parsing different formats into common fields such as source address, user and action.
- Correlates events across sources, for example a failed logon burst followed by a success and then a new admin account.
- Alerts when a rule, threshold or analytic matches.
- Stores and searches data for dashboards, investigations and compliance.
Correlation rules often use a time window, such as ten failed logons in five minutes. Newer products add analytics from UEBA (user and entity behaviour analytics), which compare activity with a learned baseline.
What an EDR does
An EDR records process creation, file changes, registry edits, network connections and logons on the endpoint. It detects behaviour and not only known malware files, and it keeps a history the analyst can search later.
Response actions include isolating the host from the network, killing a process, quarantining a file and collecting forensic data. Isolation is a quick containment step because the host stays powered on and reachable by the EDR console.
Related tools
| Tool | Focus |
|---|---|
| Extended detection and response (XDR) | Joins endpoint, network, email and cloud telemetry in one place |
| Network detection and response (NDR) | Analyses network traffic for threats |
| Managed detection and response (MDR) | A service where a provider monitors and responds for you |
| Antivirus | Mostly matches known malicious files and signatures |
Tuning alerts
Every detection can be wrong in two ways. A false positive is an alert for harmless activity, and a false negative is a missed attack.
Too many false positives cause alert fatigue, where analysts stop trusting alerts. Tuning means adjusting thresholds, adding allow lists for known good behaviour and improving rules, without blinding the detection to real attacks.
Reading a log
Oct 3 09:14:02 web01 sshd[2231]: Failed password for invalid user admin from 203.0.113.50 port 51234 ssh2
Oct 3 09:14:04 web01 sshd[2233]: Failed password for invalid user test from 203.0.113.50 port 51236 ssh2
Oct 3 09:14:07 web01 sshd[2236]: Failed password for root from 203.0.113.50 port 51240 ssh2
Oct 3 09:14:11 web01 sshd[2240]: Accepted password for deploy from 203.0.113.50 port 51244 ssh2One source address tried several usernames in a few seconds, including names that do not exist, and then got in as a real account. That is stronger than a single failure because it shows guessing and a probable success.
The next step is to check what the deploy account did after 09:14:11, using EDR process history and other logs. Searching on the source address across all log sources shows whether it touched other systems.
Searching efficiently
SIEM searches are faster and clearer when they filter early by time range, data source and a few fields. Regular expressions (regex) match patterns in text, such as an address format or a user name pattern. Pivoting means taking one finding, such as an address or host, and searching for it across other data.
What to remember for the exam
- A SIEM collects, normalises, correlates, alerts and retains logs.
- Normalisation turns different log formats into common fields.
- Correlation links events across sources and over time.
- An EDR agent gives deep endpoint visibility and can isolate a host.
- XDR widens EDR to more data sources, and MDR is an outsourced service.
- A false positive is a harmless alert, and a false negative is a missed attack.
- Tuning reduces alert noise, but over tuning can hide real attacks.
- Pivoting means searching other sources for an address, host or user found in an alert.
- The quality of a SIEM depends on which log sources are connected and how accurate the time stamps are.
If a question asks for the fastest way to stop a compromised laptop from spreading malware while keeping evidence, the answer is usually to isolate it with the EDR, not to power it off.
Common mistakes
Believing a SIEM stops attacks. A SIEM detects and alerts, and blocking is done by other tools or by a response action.
Mixing up false positive and false negative. A false positive is an alert with no attack, and a false negative is an attack with no alert.
Closing an alert because the first source looks clean. Check related sources, since a failed or missing log can hide the activity.
Treating antivirus and EDR as the same. Signature matching misses new behaviour, which an EDR can still record and detect.
Shutting down an infected host at once. Powering off loses volatile evidence such as running processes and memory contents.
Check yourself
What is log normalisation?
Converting different log formats into common fields so events can be searched and correlated together.
What is the main benefit of an EDR agent over a SIEM alone?
It records detailed endpoint activity and can respond on the host, for example by isolating it.
What is a false negative?
A real attack or malicious event that the detection did not alert on.
Topic 4 of 10 in Security Operations
Test yourself on Security Operations
The full CompTIA CySA+ CS0-004 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.