performing-log-source-onboarding-in-siem

name	performing-log-source-onboarding-in-siem
description	Perform structured log source onboarding into SIEM platforms (Splunk, Elastic, Sentinel, QRadar, or similar) by prioritizing sources with a tiered value framework, configuring collectors, building parsers, normalizing fields to a common schema (e.g. CIM), and validating data quality. Use when planning or executing the integration of new log sources — such as Active Directory, firewalls, EDR, VPN, DNS, or cloud audit logs — into a SIEM for security monitoring and detection.
domain	cybersecurity
subdomain	soc-operations
tags	["siem","log-onboarding","log-management","data-ingestion","parsing","normalization","soc"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]
mitre_attack	["T1078","T1685.002","T1685.005","T1566"]

Performing Log Source Onboarding in SIEM

Overview

Log source onboarding is the systematic process of integrating new data sources into a SIEM platform to enable security monitoring and detection. Proper onboarding requires planning data sources, configuring collection agents, building parsers, normalizing fields to a common schema, and validating data quality. According to the UK NCSC, onboarding should prioritize log sources that provide the highest security value relative to their ingestion cost.

When to Use

• When conducting security assessments that involve performing log source onboarding in siem
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• SIEM platform deployed (Splunk, Elastic, Sentinel, QRadar, or similar)
• Network access from source systems to SIEM collectors
• Administrative access on source systems for agent installation
• Common Information Model (CIM) or equivalent schema documentation
• Change management approval for production system modifications

Log Source Priority Framework

Tier 1 - Critical (Onboard First)

Source	Log Type	Security Value
Active Directory	Security Event Logs	Authentication, privilege escalation
Firewalls	Traffic logs	Network access, C2 detection
EDR/AV	Endpoint alerts	Malware, process execution
VPN/Remote Access	Connection logs	Unauthorized access
DNS Servers	Query logs	C2 beaconing, data exfiltration
Email Gateway	Email security logs	Phishing, BEC

Tier 2 - High Priority

Source	Log Type	Security Value
Web Proxy	HTTP/HTTPS logs	Web-based attacks, data exfiltration
Cloud platforms (AWS/Azure/GCP)	Audit logs	Cloud security posture
Database servers	Audit/query logs	Data access, SQL injection