SOC Analyst · Lesson 2 of 8
Searching security events
A security information and event management system, or SIEM, brings events together for searching and investigation. A useful search has a clear purpose and a bounded scope.
Make a search repeatable
An example search plan, not syntax for a particular SIEM.
- QuestionWhat happened around this sign-in?
Keep the investigation purpose explicit.
- Accountjlee
Use the account field from the chosen source.
- Window09:00–09:20 UTC
Record both bounds and the time zone.
- SourceSign-in events
Compare failures and successes; check collection coverage.
Read the visualNo events were returned. What should you check first?
Check the source, filters, time interpretation, and collection coverage before concluding that nothing happened.
Choose fields
Identify the account, device, action, result, and timestamp fields available in the data. Field names differ between tools.
Start narrow, then expand
Begin with the alert entity and relevant time range. Broaden deliberately if nearby activity could explain the event.
Keep the search reproducible
Record the filters, time zone, and source so another analyst can repeat the search. No result may mean missing data rather than no activity.
Put it in context
Search the fictional sign-in dataset for account jlee between 09:00 and 09:20 UTC, then compare successes and failures. Record the window with your findings.
A search should answer a specific question and be repeatable.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.