SIEM and Log Management

Which log sources does SIEM and log management collect?

SIEM stands for Security Information and Event Management; to avoid confusion with industrial automation brands, we use the term “SIEM and log management” here. The value of a SIEM project is determined by the coverage and quality of the logs it collects. Rather than connecting every source on day one, we recommend starting with the sources that leave the most traces along the attack chain:

• Identity: Active Directory and Microsoft Entra ID sign-ins, account lockouts and group membership changes.
• Network perimeter: firewall allow/deny logs, VPN sessions and IPS alerts.
• Endpoint: EDR/XDR detections and Windows security event logs.
• Servers and applications: Linux privilege escalation logs, web server access logs and database administrator actions.
• Cloud and email: Microsoft 365 audit logs and email security gateway events.
• Infrastructure: VMware management actions and backup system events; records such as deleted backups or changes to retention policies can be an early sign of ransomware preparation.

Service assurance: Because collected logs can contain personal data, retention and access rules are designed together with privacy principles. MAV Cloud’s information security management system is ISO/IEC 27001 certified and its privacy information management system is ISO/IEC 27701 certified (see our certifications).

Correlation rules: from individual logs to security incidents

Records that look harmless on their own can form an attack scenario when they occur in a certain order and time window. Correlation rules define that relationship. Common examples:

• Many failed sign-in attempts in a short time, followed by a successful sign-in with the same account (password guessing attack).
• The same user signing in from two distant locations within a time frame that is physically impossible.
• A new member added to an admin group outside business hours.
• An unusual volume of outbound connections and data egress from a server.
• Remote desktop attempts to adjacent systems from the same device after an EDR detection.

Rules that are not tuned to the organization generate unnecessary alerts. In the first weeks, thresholds and exceptions are reviewed, and the rule set is updated regularly. Each rule comes with a short investigation note describing which additional records the analyst should check when the alert fires and when to escalate the incident, so the same scenario is handled consistently across shifts. The fundamentals are covered in our guide What is SIEM?

Log retention and integrity

The retention plan is built in two tiers: hot storage, which supports fast searches (for current incident investigations), and an archive kept for longer periods. Retention periods required by regulation are confirmed with the organization’s legal team; on the technical side, timestamps, access restrictions and integrity checks are applied to demonstrate that logs have not been altered.

The main driver of retention cost is daily log volume. Rather than keeping every field from every source indefinitely, security-relevant event types are filtered, and repetitive, low-value records (such as routine connection status messages) are routed straight to the archive. During planning, the following questions are clarified:

• How many days should each source’s logs remain quickly searchable?
• How quickly do archived records need to be retrieved during an investigation?
• Who can access the logs, and how is that access itself logged?
• Where is the archive stored, and does the data need to stay in Türkiye?

On MAV Cloud infrastructure, the log archive can be kept in a data center in Türkiye. When alerts need to be reviewed 24/7, the setup is operated together with our SOC service.