Why this matters
The security operations centre (SOC) is where many analysts start. Ghanaian telcos, banks and fintechs, as well as managed security providers serving clients across Africa, run SOCs. Remote and regional SOC adverts commonly ask for SIEM experience, alert triage, ticketing and clear documentation.
What a SIEM does
A SIEM (security information and event management) system collects logs from many sources: firewalls, servers, laptops, email and business apps. It stores them in one place, lets analysts search them and uses rules to raise alerts, such as "ten failed logins then a success within five minutes". Examples named in adverts include Splunk, Microsoft Sentinel, Elastic and QRadar. You do not need to know them all; the thinking is the same.
Triage: deciding what is real
Triage means sorting alerts by what they really are and how urgent they are. For each alert, a Level 1 analyst:
- Reads the alert: what rule fired, on which system, for which user, when.
- Enriches it: Is the IP address known to be bad? Is the user travelling? Is this a critical server? Has this happened before?
- Decides:
- True positive: real malicious activity. Escalate.