What signals does the SIEM contribute to detection?
The SIEM centralizes logs from sources that often have no detection of their own: domain controllers, VPNs, firewalls, proxies, business applications and cloud services. It is also usually where the most history is kept. In May 2025, the Australian Cyber Security Centre (ACSC) and CISA, together with other agencies, published guidance on SIEM and SOAR that devotes an entire document to which logs to prioritize for ingestion. The most used signals:
| Signal | Examples | What it's for |
|---|---|---|
| Correlation rule alerts | Notables or findings in Splunk Enterprise Security, incidents in Microsoft Sentinel, offenses in QRadar, YARA-L detections in Google SecOps, alerts in Elastic Security | Entry point for triage |
| Authentication | Windows events 4624, 4625, 4768 and 4769, VPN and single sign-on | Use of stolen credentials, brute force, Kerberoasting and lateral movement |
| Network and perimeter | Firewall, proxy and DNS | Communication with command-and-control servers, downloads and exfiltration |
| Cloud and SaaS | Audit logs from AWS, Azure, Google Cloud and Microsoft 365 | Permission changes, new keys and anomalous access |
| Sources without an EDR agent | Business applications, databases and network devices | Context the EDR doesn't see |
What does Ciberia detect on top of your SIEM?
- Correlation by user and device: what the SIEM, the EDR, identity and email see separately about the same account or machine is grouped into a single case.
- Intelligence context: every IP, domain or hash in a SIEM alert is checked against Ciberia Intel.
- Automated triage: proprietary AI handles around 90% of triage and escalates what needs an analyst, with context.
- Retrospective hunting: Ciberia's Threat Hunting uses the history to look for persistence and lateral movement based on MITRE ATT&CK hypotheses, and turns its findings into new detection rules.
Which response actions are orchestrated?
The SIEM is used mainly to detect and investigate; containment is carried out in the integrated tools. Depending on the platform:
- In the SIEM: update the incident status and comments, run searches and add indicators to watchlists (watchlists in Microsoft Sentinel, reference sets in QRadar, lookups in Splunk).
- In identity: disable the account, revoke sessions and force a password change.
- In the EDR: isolate the device or kill the process.
- In the firewall or proxy: block IP addresses and domains.
- In ticketing: open and document the case.
The AI proposes the action and an analyst validates decisions with impact. Every automatic action is logged, and with Ciberia MDR the contractual SLA is 15 minutes from critical alert to initial containment.
Why doesn't Ciberia replace your SIEM?
Switching SIEMs is expensive: custom rules, parsers, years of history, and dashboards and reports used by other departments. Ciberia integrates with your SIEM and works on top of it, so all of that stays where it is. What changes is that every alert is investigated at any hour, with context and the ability to respond.
Compared with the other integrations, the SIEM brings breadth and history. The EDR provides device-level detail and direct containment, identity tells you who did what, and threat intelligence provides external context. If you don't have a SIEM, Ciberia also integrates directly with EDR/XDR, firewall, email, identity and cloud.
What should you check in your SIEM?
- Which sources it actually ingests and which are missing, starting with domain controllers, VPN and cloud audit logs.
- How many rules are active and how many only generate noise.
- Retention: whether your history covers the time an attacker can spend inside before being detected.
- Synchronized time and consistent user and device names across sources: without them, correlation fails.
