## 5 Results and Use Case  
### IT Infrastructure Onboarding to the SIEM  
The main task of SIEM is to collect, normalize, aggregate, and analyze event logs and data from all the data and log sources within the organization in combination with the threat intelligence sources [32]. The SIEM gathers the logs from all the IT infrastructure, including security systems, operating systems, databases, and network infrastructure, to provide full visibility on the logs and security events in near-real time and combine it with contextual information about users, assets, threats, and vulnerabilities to enable security analysts to detect, investigate, and respond to cybersecurity threats in real time, as well as to comply with regulatory requirements by storing and analyzing log data. Implementing an SIEM solution involves more than just a straightforward installation process; it must be carefully tailored to the specific context and needs of each organization. The optimal SIEM deployment strategy for one organization may be entirely unsuitable for another, as various factors such as industry, company size, geographical location, and other unique characteristics can significantly influence deployment decisions. Each organization possesses its own distinct information system and architectural framework. For instance, some companies may be geographically dispersed, necessitating highly available services, and they may generate vast amounts of logs in diverse formats. As such, a one-size-fits-all approach is not feasible, and the SIEM solution must be customized to align with the particular requirements and operational environment of the organization. That is why a preparation phase is mandatory to identify the organizational requirements and the specific needs that the SOC is intended to address, as well as the objectives and the available resources to select the target model. In general, after understanding the scope and determining the specific security requirements and compliance standards that the SIEM needs to address as the architecture design and assets prioritization, the step of the log source integration takes place to feed the SIEM engine with the event logs, and it follows this order:  
* Data Collection: The SIEM can collect logs from all kinds of devices that can generate logs on the organization's IT environment using various methods, including agent-based and agentless approaches, and whether the technology is supported or not by adapting its raw logs data. While companies do not have the same architecture, technologies, and device products, the target model is supposed to provide the maximum coverage to fill the technology gap;
* Normalization: The collected data come in various formats, and not all of them are supported by the SIEM by default, as there is a scope of supported technologies for each SIEM solution, and log sources not belonging to the scope need further normalization to extract the relevant information and making it easier to analyze and correlate events across different sources;Aggregation and Storage: After normalization, the SIEM aggregates the data and stores it in a centralized database. To facilitate streamlined log analysis, correlation, and historical investigation;
* Alerting and Reporting: When the SIEM identifies a potential security threat, it generates alerts to notify security analysts. These alerts are prioritized based on the severity of the detected event. SIEM solutions also provide reporting capabilities to support compliance and auditing requirements, as well as to offer insights into the security posture of the organization;
* Forensics and Incident Response: In the event of a security incident, SIEM systems provide detailed forensic data that helps analysts understand the attack's scope and impact.