Perform Threat Detection and Investigation in Cloud Environments Using SIEM

You are a Cloud SOC Analyst at CyberSecure Solutions. The SIEM has detected suspicious activity in the organization's cloud environment.

Your task is to analyse cloud logs, identify the suspicious activity, investigate the incident, determine its impact, and document your findings.

Topic: Cloud Monitoring and Visibility

1) Cloud Environment Visibility & Architecture

2) Cloud Logging & Monitoring

3) Threat Detection in Cloud Environments

Objective

Understand what information is available in cloud logs.​

Open the SIEM dashboard.

Navigate to cloud security events.

Select the assigned time range.

Review events containing:

• Username

• Source IP

• Resource

• Action

• Timestamp

• Event status

Expected Output

• Username

• Source IP

• Resource

• Action

• Timestamp

• Event status

Identify unusual events.

Students identify relevant cloud events for investigation.

Objective

Identify potential threats from cloud events.

Repeated failed logins.

Login from an unexpected source.

IAM permission changes.

New user creation.

Look for activities such as:

Unusual resource creation.

Security configuration changes.

Unexpected resource deletion.

Example

Expected Output

Students identify at least one suspicious cloud activity.

Objective

Determine whether the activity represents a real security incident.

Open the SIEM alert.

Identify the:

• User

• Source IP

• Cloud resource

• Timestamp

• Action

Search for related events.

The endpoint appears as an active agent in the SIEM.

Check what happened before and after the alert.

Build a simple incident timeline.

Objective

Verify that endpoint logs are being sent to the central system.

Generate simple test activities on the endpoint:

• Successful login.

• Failed login.

• File creation.

• File deletion.

• Service start/stop.

Open the SIEM dashboard.

Search for the generated events.

Example

Verify that the events came from the correct endpoint.

Expected Output

Students can see endpoint events in the central SIEM.

Objective

Understand how centralised logs can be used for monitoring.

Select one collected event.

Review:

• Timestamp

• Hostname

• Username

• Event type

• Source

• Severity

Determine whether the event is normal or suspicious.

Record your findings.

Expected Output

Students analyze an endpoint event using centralized SIEM data.

Objective

Understand common reasons why logs may not appear.

If logs are not being received, check:

Is the agent service running?

Is the endpoint connected to the network?

Is the SIEM server reachable?

Is the agent correctly registered?

Is the required firewall/network communication allowed?

Check the agent logs for errors.

Restart the agent if required.

Verify log collection again.

Expected Output

The endpoint successfully communicates with the SIEM and sends logs.

Objective

Create a basic centralised logging report.

Record:

Example Finding

Endpoint: TEST-PC01

Implementation:

A SIEM agent was installed and connected to the

central monitoring server.

Verification:

The endpoint successfully sent authentication

and system events to the SIEM.

Status:

Centralized log collection successfully implemented.

Example Finding

Endpoint: TEST-PC01

Implementation:

A SIEM agent was installed and connected to the

central monitoring server.

Verification:

The endpoint successfully sent authentication

and system events to the SIEM.

Status:

Centralized log collection successfully implemented.

Expected Output

Click Here for the Output

Great job!

After completing this lab, students will be able to explain centralised log collection, understand the role of SIEM agents, install and configure an endpoint agent, connect endpoints to a central SIEM, verify log collection, analyse centralised endpoint logs, and troubleshoot basic agent connectivity issues.

Topic: Log Management and Analysis

• Log collection and log analysis