Incident Detection and Triage · Topic 2 of 6
Deploying a SIEM and Managing Use Cases
Learn how a SOC plans and deploys a SIEM, onboards and tunes log sources, and builds, tests and reviews SIEM use cases over their lifecycle for CSA 312-39.
- 5 min
- Deployment starts with objectives and scope, not with buying a product.
- Size with EPS and storage per day, and plan retention from policy and regulation.
- Roll out in phases, starting with high value sources such as domain controllers, firewalls and endpoints.
What it is
Deploying a SIEM means planning, installing and connecting the platform so that it collects the right data and supports the SOC's detection goals. A rushed deployment that skips planning usually ends with too many alerts and too little value.
A use case is a defined detection scenario: what threat to detect, which data it needs, the logic that detects it, and what the analyst should do when it fires. Use case management is the ongoing work of creating, testing, tuning and retiring those scenarios.
How it works
Deploying a SIEM
| Stage | What happens |
|---|---|
| Define objectives and scope | Agree what the SIEM must achieve: threat detection, compliance, investigation. Identify critical assets and regulations |
| Gather requirements | List log sources, expected volume, retention period, users and integrations |
| Size the platform | Estimate events per second (EPS) and daily storage, with room for growth |
| Choose the model | In-house, cloud, managed or hybrid, based on budget, skills and data residency |
| Design the architecture | Collector placement, network paths, storage tiers, high availability |
| Pilot | Start with a small set of high value sources and a few use cases |
| Phased rollout | Add sources in priority order rather than everything at once |
| Tune | Adjust thresholds and filters to cut false positives |
| Operationalize | Document procedures, train analysts, assign owners, define escalation |
Start with the sources that see the most attacker activity: domain controllers and authentication logs, firewalls and VPN, endpoint and EDR telemetry, proxy and DNS, email gateway, and critical servers.
Check that every source is actually arriving and parsing correctly. A source that stops sending logs creates a silent blind spot, so a "no logs received" alert is a basic health check.
What a use case contains
| Element | Example for "brute force followed by success" |
|---|---|
| Objective | Detect password guessing that succeeds |
| Threat mapping | MITRE ATT&CK Brute Force (T1110) |
| Data sources | Windows Security log from domain controllers and servers |
| Logic | Many 4625 events for one account, then a 4624 for it, within a short window |
| Severity | High when the account is privileged |
| Response | Validate with the user, check source address, escalate to Tier II if confirmed |
| Owner and review date | Detection engineer, reviewed each quarter |
The use case lifecycle
- Identify the need. Risk assessment, threat intelligence, past incidents, audit findings or compliance rules.
- Design. Define logic, data needed, severity and the response steps.
- Check data. Confirm the needed logs are collected and parsed. If not, onboard the source first.
- Implement. Build the rule, alert and dashboard element.
- Test. Simulate the activity safely and confirm the rule fires, and that normal activity does not.
- Tune. Adjust thresholds, add exclusions for known benign activity.
- Operate and measure. Track how often it fires and its true positive rate.
- Review or retire. Update when the environment or threat changes. Remove rules that only produce noise.
Mapping use cases to MITRE ATT&CK shows coverage. The SOC can see which techniques have a detection and which do not, and plan new use cases to close gaps.
Prioritizing use cases
Not every idea deserves a rule. Rank candidates by the risk they address, the value of the assets involved, whether data is available, and how much analyst time the alert will cost.
A worked example
A SOC's new use case alerts whenever an account is added to the Domain Admins group. In the first week it fires 40 times, all during a planned migration by the identity team.
The analyst does not disable the rule. The team adds a time limited exclusion for the approved change ticket, keeps the alert for all other changes, and records the decision with a review date.
How the exam asks about this
- "Which measure is used to size a SIEM's collection capacity?" → Events per second (EPS).
- "A use case is designed but the required logs are not being collected. What should happen first?" → Onboard and parse the missing log source.
- "Which activity reduces false positives from a new rule without losing detection?" → Tuning thresholds and adding specific exclusions.
What to remember for the exam
- Deployment starts with objectives and scope, not with buying a product.
- Size with EPS and storage per day, and plan retention from policy and regulation.
- Roll out in phases, starting with high value sources such as domain controllers, firewalls and endpoints.
- A use case has an objective, data sources, logic, severity, response steps and an owner.
- Use cases follow a lifecycle: identify, design, implement, test, tune, operate, review or retire.
Turning on every vendor default rule at go live floods analysts with alerts and causes alert fatigue. Enable a small, tested set and grow it.
Common mistakes
Collecting everything without a goal. Ingestion costs money and adds noise. Collect what the use cases need, plus what investigations and compliance require.
Never testing rules. A rule that has never been triggered in a test may not work at all, and the SOC will believe it is covered when it is not.
Disabling a noisy rule instead of tuning it. That removes the detection completely. Narrow the logic or add specific exclusions.
Check yourself
What is a SIEM use case?
A defined detection scenario that states the threat, the data needed, the detection logic and the response steps.
Why should SIEM deployment be phased?
It lets the team confirm each source parses correctly and tune rules before adding more volume and noise.
How does MITRE ATT&CK help use case management?
Mapping use cases to its techniques shows which attacker behaviors are covered and where detection gaps remain.
Topic 2 of 6 in Incident Detection and Triage
Test yourself on Incident Detection and Triage
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.