Perform structured log source onboarding into SIEM platforms (Splunk, Elastic, Sentinel, QRadar, or similar) by prioritizing sources with a tiered value framework, configuring collectors, building parsers, normalizing fields to a common schema (e.g. CIM), and validating data quality. Use when planning or executing the integration of new log sources — such as Active Directory, firewalls, EDR, VPN, DNS, or cloud audit logs — into a SIEM for security monitoring and detection.
Perform structured log source onboarding into SIEM platforms (Splunk, Elastic, Sentinel, QRadar, or similar) by prioritizing sources with a tiered value framework, configuring collectors, building parsers, normalizing fields to a common schema (e.g. CIM), and validating data quality. Use when planning or executing the integration of new log sources — such as Active Directory, firewalls, EDR, VPN, DNS, or cloud audit logs — into a SIEM for security monitoring and detection.
Log source onboarding is the systematic process of integrating new data sources into a SIEM platform to enable security monitoring and detection. Proper onboarding requires planning data sources, configuring collection agents, building parsers, normalizing fields to a common schema, and validating data quality. According to the UK NCSC, onboarding should prioritize log sources that provide the highest security value relative to their ingestion cost.
When to Use
When conducting security assessments that involve performing log source onboarding in siem
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
SIEM platform deployed (Splunk, Elastic, Sentinel, QRadar, or similar)
Network access from source systems to SIEM collectors
Administrative access on source systems for agent installation
Common Information Model (CIM) or equivalent schema documentation
Change management approval for production system modifications
Log Source Priority Framework
Tier 1 - Critical (Onboard First)
Source
Log Type
Security Value
Active Directory
Security Event Logs
Authentication, privilege escalation
Firewalls
Traffic logs
Network access, C2 detection
EDR/AV
Endpoint alerts
Malware, process execution
VPN/Remote Access
Connection logs
Unauthorized access
DNS Servers
Query logs
C2 beaconing, data exfiltration
Email Gateway
Email security logs
Phishing, BEC
Tier 2 - High Priority
Source
Log Type
Security Value
Web Proxy
HTTP/HTTPS logs
Web-based attacks, data exfiltration
Cloud platforms (AWS/Azure/GCP)
Audit logs
Cloud security posture
Database servers
Audit/query logs
Data access, SQL injection
DHCP/IPAM
Address allocation
Asset tracking
File servers
Access logs
Data access monitoring
Tier 3 - Standard
Source
Log Type
Security Value
Application servers
App logs
Application-level attacks
Print servers
Print logs
Data loss prevention
Badge/physical access
Access logs
Physical security correlation
Network devices (switches/routers)
Syslog
Network anomalies
Onboarding Process
Step 1: Discovery and Assessment
1. Identify the log source:
- System type and version
- Log format (syslog, CEF, JSON, Windows Events, etc.)
- Log volume estimate (EPS - events per second)
- Network location and firewall requirements
2. Assess security value:
- What threats can this source help detect?
- Which MITRE ATT&CK techniques does it cover?
- Is there an existing SIEM parser?
3. Estimate ingestion cost:
- Daily volume in GB
- License impact (per-GB or per-EPS pricing)
- Storage retention requirements
