Integration with Detection Systems (SIEM)
🌟 Objective
Ensure a reliable, secure and auditable integration between the event sources (applications, infrastructure, pipelines) and the analysis and correlation system (SIEM), guaranteeing support for effective detection, response and traceability.
🧬 What SIEM integration is
It is the chain of collection, transport, transformation and ingestion of the relevant events into a SIEM, guaranteeing:
- A suitable format compatible with parsing;
- Reduced latency and resilience to failures;
- Effective correlation capability across sources.
🧑💻 The application must never communicate directly with the SIEM - always use a forwarder as an isolation layer.
📀 Typical integration architecture
[Aplicação] → [Logger] → [Forwarder/Agent] → [Parser] → [SIEM]
| Component | Main function |
|---|---|
| Logger | Emission of structured logs (e.g. JSON, ECS) |
| Forwarder | Local collection, buffering and secure forwarding |
| Parser/Ingester | Transform logs into a normalised, indexable format |
| SIEM | Analysis, correlation, visualisation and alerting |
🛠️ Functional requirements of the integration
| Requirement | Description |
|---|---|
| Supported format | JSON, CEF, LEEF, ECS, structured Syslog |
| Secure channel | TLS 1.2+ with authentication (key, token, mTLS) |
| Local buffering | The forwarder must tolerate network failures |
| Tagging by application / environment | Facilitates filters and dashboards |
| Normalised timestamps | UTC, ISO 8601, synchronised via NTP |
🔧 Common tools
| Category | Examples |
|---|---|
| Forwarders | Filebeat, Fluentbit, Vector, rsyslog |
| SIEMs | Splunk, Azure Sentinel, Elastic SIEM, QRadar |
| Normalisers | Logstash, Cribl, ingest pipelines (OpenSearch, ELK) |
| Observability | Grafana, Loki, Datadog, Prometheus |
✅ Integration good practices
- Validate logs with
tcpdump,wiresharkor ingestion dashboards; - Use enrichment filters (e.g. geolocation,
user-agent,env); - Avoid redundancy (the same event sent to several destinations);
- Test forwarding with
logger,curl, replay of real logs; - Ensure safe reversion (rollback of the forwarder version, tags, etc.).
🔍 Validation of the integration
| Verification | Suggested method |
|---|---|
| Event reached the SIEM | Confirm via index or forwarder log |
| Fields were parsed correctly | Check in a dashboard or inspection query |
| Latency between generation and ingestion | Measured with timestamp vs ingest time |
| Duplicates or losses | Verification by hash / ID / expected count |
🔒 Security considerations
- Isolate the forwarders' network from the SIEM network;
- Monitor forwarding or parsing failures with alerts;
- Protect agent configurations (tokens, paths, endpoints);
- Validate that events do not contain sensitive data in the clear.
📂 Advanced integrations
- Logging of pipeline execution (CI/CD, DevOps);
- Sending events directly via API gateways and proxies;
- Correlation with session, user,
trace.id, etc.; - Dashboards per application, environment, component.
🧹 Link with other controls
| Document | Relation to this topic |
|---|---|
02-logging-centralizado.md | Defines the sources and formats of the events |
06-correlacao-anomalias.md | Uses the events for detection and correlation |
09-ameacas-mitigadas.md | Shows how the integration supports response |
08-matriz-controles-por-risco.md | Determines whether SIEM integration is mandatory |
🧠 The quality of the SIEM integration directly determines the effectiveness of the response and the traceability of the systems.