Concept Overview
This section explains the concepts behind SentriaOne xSIEM. It follows the path of the data: where it comes from, how it is processed, which capabilities analyze it, and how the security team acts on the results.
Pages in this section
| Page | Explains |
|---|---|
| Log Sources | Logs from end devices and network devices, and how they are collected |
| Packet Mirroring | How a copy of network traffic is provided for analysis |
| Data Processing | Transformation, normalization, enrichment, L2–L7 analysis, MITRE ATT&CK, and correlation |
| SIEM | Security Information and Event Management |
| NDR | ML-based Network Detection and Response |
| NPM | Network Performance Monitoring |
| Incident Response | Turning detections into decisions, actions, and tracked cases |
| Glossary | Short definitions of terms used across this documentation |
Where the concepts appear in the dashboard
| Concept | Dashboard pages |
|---|---|
| Log sources, mirroring | Data Feed Health |
| SIEM and NDR detections | Security Overview, Detections |
| NPM | Network Overview, Application Overview |
| Incident Response | Detection Details — Detection Tracking |
| Processed records | Records |
Next steps
Continue to Log Sources to learn where SentriaOne xSIEM data comes from.