SIEM Use Cases and Query Development Questions

Designing Security Information and Event Management detection use cases and implementing them as queries and alerts. Topics include identifying required data sources such as system event logs, network flow records and domain name system logs, translating attack scenarios into query logic, example query construction for platforms such as the Splunk search processing language and the Kusto query language, testing and validating detections, performance and scheduling considerations, and operationalizing detections with dashboards and cases.