Data Processing
After logs and raw traffic are received, SentriaOne xSIEM ingests and processes the data to turn it into intelligence. This page explains the terms shown in the Ingest & Process stage of the platform data flow.
Preparing the data
Transformation
Transformation converts incoming data into a structure the platform can work with — for example, parsing a single text log line into separate fields such as time, host, action, and addresses.
Normalization
Normalization maps data from different sources into one consistent set of field names and values.
Different vendors describe the same thing differently. One firewall may write
src=10.10.20.15, another source_address: 10.10.20.15. After normalization
both are stored under the same field, so a single search or detection rule
works across all sources.
Enrichment
Enrichment adds context that the original data does not contain, making it easier to understand and prioritize. Examples of context include:
- Asset information, such as which system or owner an IP address belongs to
- Geographic information for external IP addresses
- Whether an address, domain, or file matches known threat intelligence
Analyzing the data
L2–L7 analysis
Network traffic is analyzed across the layers of the OSI model, from Layer 2 (data link) to Layer 7 (application).
| Layer | Name | Examples of what can be observed |
|---|---|---|
| L2 | Data link | MAC addresses, VLANs |
| L3 | Network | IP addresses, routing |
| L4 | Transport | TCP/UDP ports, sessions, retransmissions |
| L5–L6 | Session / presentation | Session setup, encryption handshakes |
| L7 | Application | Application protocols such as HTTP, DNS, and SMB |
Deep protocol parsing decodes application-layer protocols so their content and behaviour can be inspected, not just addresses and ports.
MITRE ATT&CK
MITRE ATT&CK is a publicly available knowledge base of adversary behaviour, organized as:
- Tactics — the attacker's goal, such as Initial Access, Lateral Movement, or Exfiltration
- Techniques — how that goal is achieved
Mapping detections to ATT&CK tactics and techniques helps analysts understand where an activity sits in an attack and correlate related detections.
Threat intelligence
Threat intelligence is information about known threats, such as malicious IP addresses, domains, file hashes, and attacker techniques. Matching collected data against threat intelligence identifies contact with known malicious infrastructure.
Signature-based detection
Signature-based detection matches data against known patterns of malicious activity. It is precise for known threats, but cannot identify threats that do not yet have a signature.
Anomaly detection and behaviour analytics
Anomaly detection identifies activity that deviates from what is normal. Behaviour analytics applies this to users, hosts, and network activity — for example, a server that suddenly communicates with many internal systems it never contacted before.
SentriaOne xSIEM uses machine learning alongside signatures, so both known threats and unusual behaviour can be detected.
Correlation
Correlation links related events from different sources and times into a single, meaningful finding. A failed sign-in, followed by a successful sign-in, followed by unusual internal connections from the same host, is more significant together than any one event alone.
Outcomes
The processed and analyzed data supports three outcomes.
| Outcome | Meaning |
|---|---|
| Cyber security intelligence | Detections and context that help the security team find and stop threats |
| Compliance | Collected and retained records that support audit and regulatory needs |
| IT operations | Visibility into network and application health and performance |
See the Glossary for short definitions of all terms.