CyArt Academy
Unlock ProSign in
CYART // SCHEMA · SIEM-PIPELINE9 NODES · 9 LINKSENRICHEDALERTACTOR · Sources — cloud, EDR, auth, netACTOR01Sourcescloud, EDR, auth, netACTOR · Agents / APIs — Fluent Bit, pullACTOR02Agents / APIsFluent Bit, pullEDGE · Ingest gateway — auth, backpressureEDGE03Ingest gatewayauth, backpressureSTREAM · Stream — Kafka, per-tenant topicsSTREAM04StreamKafka, per-tenant topicsSERVICE · Normaliser — parse → OCSF/ECSSERVICE05Normaliserparse → OCSF/ECSSERVICE · Detection — rules, correlation, MLSERVICE06Detectionrules, correlation, MLDATA · Hot store — 7 to 30 d, searchDATA07Hot store7 to 30 d, searchDATA · Cold store — object store, 1 y+DATA08Cold storeobject store, 1 y+DATA · Cases / alerts — dedupe, SOARDATA09Cases / alertsdedupe, SOAR

Security logging architecture

Which logs matter, how to collect them without losing any, how long to keep them and how to make them searchable when it counts.

● Must know for interviews🔒 PROLesson·26 min read·Intermediate → Advanced
loggingSIEMtelemetryretention

01The logs that solve incidents

✓What you will learn
  • Prioritise log sources by investigative value
  • Design a lossless pipeline with backpressure and buffering
  • Pick hot / warm / cold tiers and retention
  • Normalise to a common schema (OCSF / ECS) early
SourceAnswersPriority
Identity provider / SSOWho logged in, from where, with which factor1
Cloud audit (CloudTrail, GCP Audit)Who changed infra, who read secrets1
EDR / endpointWhat ran on the host, process trees1
Application auth + authzWho accessed which object2
DNS + egress proxyWhere data went2
Network flowLateral movement3
FigA security log pipeline
CYART // SCHEMA · SIEM-PIPELINE9 NODES · 9 LINKSENRICHEDALERTACTOR · Sources — cloud, EDR, auth, netACTOR01Sourcescloud, EDR, auth, netACTOR · Agents / APIs — Fluent Bit, pullACTOR02Agents / APIsFluent Bit, pullEDGE · Ingest gateway — auth, backpressureEDGE03Ingest gatewayauth, backpressureSTREAM · Stream — Kafka, per-tenant topicsSTREAM04StreamKafka, per-tenant topicsSERVICE · Normaliser — parse → OCSF/ECSSERVICE05Normaliserparse → OCSF/ECSSERVICE · Detection — rules, correlation, MLSERVICE06Detectionrules, correlation, MLDATA · Hot store — 7 to 30 d, searchDATA07Hot store7 to 30 d, searchDATA · Cold store — object store, 1 y+DATA08Cold storeobject store, 1 y+DATA · Cases / alerts — dedupe, SOARDATA09Cases / alertsdedupe, SOAR
  • ACTOR
  • EDGE
  • SERVICE
  • DATA
  • STREAM
  • Live flow
  • Lookup / async
//Agents and APIs push into an authenticated ingest gateway with backpressure. A durable stream decouples producers from consumers. Normalisers emit a common schema to a hot store for search and a cold store for retention. Detection consumes the same stream and opens cases.

This is an advanced module

Detection & Response Engineering is part of the Pro pass. 1 more section — the deep dives, the final design, follow-ups and the test — unlock with it.

Enter access codeSee Pro pass

Already a cyart.io or studio.cyart.io member? Your pass code is in your Studio account.