Security Fundamentals and Core Concepts Questions

Overview (role lens)
As a Security Architect I view these tool classes as complementary layers: detection/aggregation (SIEM), orchestration/automation (SOAR), endpoint prevention/visibility (EDR), and data-focused controls (DLP). Each fills a distinct function in detection, response, and prevention.

SIEM

• Purpose / placement: Central log aggregator and correlation engine for enterprise telemetry; lives in security analytics layer feeding SOC.
• Vendor example: Splunk Enterprise Security.
• Primary data source: Syslogs, application logs, network devices, cloud audit logs.
• Limitation: Alert fidelity depends on log quality; noisy or missing logs cause blindspots and false positives.

SOAR

• Purpose / placement: Automates playbooks, incident orchestration and case management; sits between SIEM/IT tools and responders.
• Vendor example: Palo Alto Cortex XSOAR.
• Primary data source: SIEM alerts and ticketing APIs.
• Limitation: Over-automation risk—poor playbooks can escalate mistakes; needs mature processes.

EDR

• Purpose / placement: Endpoint visibility, behavioral detection, containment/response; deployed on desktops/servers.
• Vendor example: CrowdStrike Falcon.
• Primary data source: Endpoint telemetry (processes, drivers, file hashes, behavioral events).
• Limitation: Gaps on unmanaged/IoT devices; telemetry volume and privacy constraints.

DLP

• Purpose / placement: Prevents exfiltration and enforces data handling policies at rest, in use, and in motion; placed on endpoints, gateways, and cloud apps.
• Vendor example: Forcepoint DLP.
• Primary data source: File content/metadata, email, cloud storage events.
• Limitation: High false positive rate and user workflow friction; requires accurate data classification.

I design integrations emphasizing standardized schemas, test harnesses for playbooks, and phased rollouts to manage these limitations.