Identity telemetry & SIEM

Zara watches every login, failed password and push prompt. Each one is a security signal. Your goal: turn identity logs into alerts you can act on.

Logs that warn you

Identity is the new edge of your network. So identity events are security telemetry. A defender watches them as they happen. Examples are many failed passwords, a login from a new country and a flood of push prompts. A SIEM collects these events in one place. SIEM means security information and event management. Open-source tools such as Wazuh and OpenSearch can do this job. This helps detection and response stop attacks early.

From raw log to tagged alert

Raw logs are noise until you normalize them. A normalizer puts every event into one common form. It tags each login event with three things: a MITRE ATT&CK technique, a Sigma rule and a severity. ATT&CK is a public list of attacker behavior, such as T1110 Brute Force. Sigma is a vendor-neutral way to write a detection rule that many tools can run. With these tags, Zara can filter by technique and sort by severity. She sees the accounts and IP addresses involved. She does not read raw JSON.

Rules, noise and misses

A detection rule counts events in a time window. For example: 5 failed logins from one IP address in 5 minutes. If the limit is too low, Priya mistyping her password twice wakes Zara for nothing. That is a false positive. If the limit is too high, a real attack slips by. Good tuning balances the two.

One pipe, many sources

Attack tests, live log streams and other detectors all use the same normalizer. So Zara reads one feed, not a dashboard for each tool. Send logs to your SIEM as they happen, over a signed, authenticated endpoint. Do not poll an admin API on a timer. Do not copy every log to every tool. Scope the stream. Alert on the high-signal events: blocked brute force, use of a breached password and token reuse.