Foundation glossary/Operations
SIEM
Companion card for the Foundation course — study the related lesson for full progress.
Simple explanation
Central security camera room for logs and alerts.
Technical explanation
Collect, normalize, correlate, alert.
Real-life scenario
Like a mall security desk watching many camera feeds at once — for IT logs.
Security relevance
Without centralized logs and correlation, SOC triage is guesswork.
Practical example
Failed logons + odd geo → high-priority case.
Collect
Normalize
Correlate
Alert
Mini quiz
A SIEM’s main job is closest to:
Related lesson
No direct lesson slug yet — use the Foundation course syllabus or roadmap level soc.