SIEM Foundations
SIEM Foundations: Evidence-First Triage
Program narrative
This cohort anchors you in log discipline, correlation hygiene, and analyst-to-engineer handoffs. You will rebuild a week of synthetic incidents with instructor review, then defend your narrative in a short tabletop review. The emphasis stays on defensible notes, not theatrical tooling.
What is included
- Telemetry notebooks with annotated pivots
- Role clarity between L1 triage and L2 owners
- Dashboard pack for queue health and backlog aging
- Quality standards checklist mapped to your runbooks
- Warm handoff template for vendor tickets
- Peer review rubric for alert writeups
Outcomes you can evidence
- Ship a triage packet leadership can skim in under two minutes
- Cut duplicate escalations by clarifying ownership per queue
- Standardize severity language across two shift patterns
Course questions
No. Labs run in an isolated tenant. If you want to mirror exercises internally, we provide exportable queries only—no vendor secrets are required.
Cohort voices
The Foundations triage packet template is now our default attachment for escalations. Instructors annotated my timeline twice—specific, not generic.
Week three correlation lab finally made parent/child events click. Still wish we had one more hour on syslog quirks.