SIEM & Log Analysis Tools
SIEM and log analysis tools help security teams collect, correlate, and analyze telemetry from across an organization. These tools support detection engineering, threat hunting, alert triage, and incident response by turning raw logs into actionable insights.
Elastic Security (ELK Stack)
Elastic Security is a SIEM and endpoint security platform built on Elasticsearch, Logstash, and Kibana. It provides log ingestion, correlation, detection rules, dashboards, and timeline investigations. Elastic is widely used in SOCs for threat hunting and alert triage.
Why it’s useful: Teaches how modern SIEM pipelines work — from log ingestion to correlation to detection engineering — all in an open and extensible platform.
Difficulty: Intermediate
Wazuh
Wazuh is an open-source SIEM and XDR platform that provides log analysis, intrusion detection, file integrity monitoring, vulnerability detection, and compliance checks. It integrates with Elastic for visualization and alerting.
Why it’s useful: Great for learning SIEM fundamentals and understanding how endpoint telemetry feeds into detection pipelines.
Difficulty: Intermediate
Graylog
Graylog is a centralized log management platform that supports ingestion, parsing, alerting, dashboards, and correlation. It is known for its scalability and ease of use in enterprise environments.
Why it’s useful: Helps learners understand log pipelines, parsing rules, and how SOCs build dashboards and alerts.
Difficulty: Beginner
Splunk Free
Splunk is a leading enterprise SIEM and log analytics platform. The free edition allows indexing and searching logs, building dashboards, and experimenting with SPL (Search Processing Language).
Why it’s useful: SPL is widely used in SOCs — learning it gives analysts a major advantage in detection engineering and threat hunting.
Difficulty: Intermediate
Sigma Rules
Sigma is an open, generic rule format for SIEM detections. Sigma rules can be converted into queries for many SIEMs, including Elastic, Splunk, Sentinel, and QRadar.
Why it’s useful: Teaches how detections are written in a vendor‑agnostic way and how SOCs standardize detection engineering.
Difficulty: Advanced
Sysmon
Sysmon is a Windows system monitoring tool that logs detailed process, network, and registry activity. It is commonly used with SIEMs to provide high‑fidelity telemetry for detection engineering.
Why it’s useful: Shows how endpoint telemetry becomes the backbone of SIEM detections and threat hunting.
Difficulty: Intermediate