Chapter 01
The pipeline
- ✓Collect, parse, normalize, enrich, store, detect
- ✓UTC versus index time, UDP syslog, and events per second
- ✓Which Windows events and which sources to onboard first
← All guides
🔭 Blue team · 40 pages
The SIEM, from the first log to a threat model you can defend.
How events become alerts, the small failures that drop them, and use cases from password spray to ransomware precursors — with the same idea in Splunk, Sentinel, Elastic, and Wazuh.
“If the alert does not open back into the raw event, it is a rumor. This book is how you stop shipping rumors.”— Rishav Bhardwaj
Why you need this — honestly
- You have a SIEM and still cannot say where a log died before it became an alert.
- You need beginner detections and the multi-step models: phish to mailbox, spray to a server, a beacon, a quiet log source.
- You want one use-case card you can copy, not a poster of MITRE techniques.
What's inside
Written in plain language. No jargon for the sake of jargon. Every section ends with something you can do, not just read.
Chapter 02
Advanced architecture
- ✓The five tiers drawn, plus hubs: Kafka, Event Hubs, Kinesis, Pub/Sub
- ✓Topologies for Splunk, Sentinel, Elastic, QRadar, and Wazuh
- ✓Syslog that survives a restart, EPS sizing math, and HA
Chapter 03
Connectors and integration
- ✓A connector card and runbook per source: Windows, Linux, firewall, identity, email, EDR, cloud, Kubernetes
- ✓The nine-gate integration process and a source acceptance test
- ✓Migration and multi-SIEM without lying about coverage
Chapter 04
Use cases
- ✓Beginner: spray, failure-then-success, admin group, log cleared
- ✓Intermediate: impossible travel, MFA fatigue, mailbox rule, beacon
- ✓Advanced threat models with the response written on the diagram
Chapter 05
A program
- ✓Tuning without going blind
- ✓Five numbers a lead can use
- ✓Ninety days to a SIEM analysts trust
Perfect if you are…
SOC analystsPeople standing up a SIEMDetection engineers who want the why
Related guides
Pair The SIEM Book with these — each is a separate instant-download PDF by Rishav Bhardwaj.
Deep Phishing Analysis
Headers, kits, device-code abuse & AiTM — like a real SOC lead teaches it.
View guide →
Malware Analysis Bible
Static, dynamic, behavioral — with a lab mindset that sticks.
View guide →
SIEM Detection Rules & Use Cases
High-signal detections, logic, and tuning notes — not noise.
View guide →
Cloud Security, A to Z
IaaS to GRC — identity, crypto, network, DevSecOps, and incidents across AWS, Azure, and GCP.
View guide →
How a SIEM works, from the first log to a threat model
This book is the pipeline, the small ways a log dies, and the detections a queue can run — beginner rules through multi-step threat models.
- Collect, parse, time, and retention, including UTC versus index time
- Beginner use cases: spray, brute force, admin changes, a cleared log
- Intermediate and advanced models: mailbox takeover, lateral movement, ransomware precursors
- A 90-day stand-up and the numbers a shift lead actually needs
Common questions
- Does this replace a Splunk or Sentinel course?
- It teaches the job those tools share. Queries are shown so you can translate them. The use case and the threat model stay the same when the screen changes.
Instant PDF download
The SIEM Book
$12.02
40 pages · 5–6 hours · one-time purchase
International checkout
After you continue to payment, on the Cashfree page please select PayPal (scroll to International Walletif you don't see it).
Prices on this site are in USD. Cashfree may show the equivalent in ₹ — that is normal; PayPal lets you pay from outside India.
✓ 7-day money-back guarantee · instant PDF delivery · no subscription
847 professionals already downloaded this
Want every guide? Complete bundle for $43.35 →
Want live guidance? Book a 1-on-1 with me →
About me
Rishav Bhardwaj — cybersecurity practitioner & author of Cyber Rishav
I've trained 200+ analysts, built blue-team programs inside real enterprises, and still sit in the work — SOC triage, cloud risk, GRC, and IR. These guides are the same structured thinking I use in programs and 1-on-1s, written so you can act this week, not someday.
CISSPCCSKSecurity+CEHISO 27001
Rishav Bhardwaj
Cybersecurity practitioner · Blue team
200+
Analysts coached
10K+
Enterprise seats in IR programs
12
Deep-dive guides
Every guide in this library is something I use when coaching analysts and building programs — not content farm filler. If it does not help you act this week, it does not ship.