Perform structured log source onboarding into SIEM platforms by configuring collectors, parsers, normalization, and validation for complete security visibility. Use when performing structured log source onboarding into siem platforms by configuring.
Perform structured log source onboarding into SIEM platforms by configuring collectors, parsers, normalization, and validation for complete security visibility. Use when performing structured log source onboarding into siem platforms by configuring.
Log source onboarding is the systematic process of integrating new data sources into a SIEM platform to enable security monitoring and detection. Proper onboarding requires planning data sources, configuring collection agents, building parsers, normalizing fields to a common schema, and validating data quality. According to the UK NCSC, onboarding should prioritize log sources that provide the highest security value relative to their ingestion cost.
When to Use
Trigger phrases:
"performing log source onboarding in siem"
"Perform structured log source onboarding into SIEM platforms by configuring coll"
When conducting security assessments that involve performing log source onboarding in siem
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
SIEM platform deployed (Splunk, Elastic, Sentinel, QRadar, or similar)
Network access from source systems to SIEM collectors
Administrative access on source systems for agent installation
Common Information Model (CIM) or equivalent schema documentation
Change management approval for production system modifications
Log Source Priority Framework
This section covers log source priority framework for performing log source onboarding in siem.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
Tier 1 - Critical (Onboard First)
Source
Log Type
Security Value
Active Directory
Security Event Logs
Authentication, privilege escalation
Firewalls
Traffic logs
Network access, C2 detection
EDR/AV
Endpoint alerts
Malware, process execution
VPN/Remote Access
Connection logs
Unauthorized access
DNS Servers
Query logs
C2 beaconing, data exfiltration
Email Gateway
Email security logs
Phishing, BEC
Tier 2 - High Priority
Source
Log Type
Security Value
Web Proxy
HTTP/HTTPS logs
Web-based attacks, data exfiltration
Cloud platforms (AWS/Azure/GCP)
Audit logs
Cloud security posture
Database servers
Audit/query logs
Data access, SQL injection
DHCP/IPAM
Address allocation
Asset tracking
File servers
Access logs
Data access monitoring
Tier 3 - Standard
Source
Log Type
Security Value
Application servers
App logs
Application-level attacks
Print servers
Print logs
Data loss prevention
Badge/physical access
Access logs
Physical security correlation
Network devices (switches/routers)
Syslog
Network anomalies
Onboarding Process
Scope the task — define objectives, boundaries, and success criteria
Gather information — collect all necessary data and context before proceeding
Execute the core workflow — follow the domain-specific steps methodically
Validate results — verify outputs against expected outcomes or baselines
Document findings — record results, anomalies, and recommendations
Step 1: Discovery and Assessment
1. Identify the log source:
- System type and version
- Log format (syslog, CEF, JSON, Windows Events, etc.)
- Log volume estimate (EPS - events per second)
- Network location and firewall requirements
2. Assess security value:
- What threats can this source help detect?
- Which MITRE ATT&CK techniques does it cover?
- Is there an existing SIEM parser?
3. Estimate ingestion cost:
- Daily volume in GB
- License impact (per-GB or per-EPS pricing)
- Storage retention requirements
