SIEM event data

Identifies SIEM event data and exports - Splunk, Microsoft Sentinel, QRadar, Elastic Security alerts, notable events and security event logs - containing event IDs, security log fields, CEF/LEEF/syslog records or host addresses. These records typically contain personal information (usernames, IPs).

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: SIEM product wording is discovery-only; enforcement requires event IDs, log fields, log formats or hosts, and 85 adds a second structure and detection context.
Detection quality: Topic verified
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth), GDPR, Privacy Act 1988 (Cth)
Frameworks: ISO 27001, NIST CSF, CIS Controls
Data categories: security, technology, pii
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:SIEM\s+(?:events?|alerts?|exports?|search(?:es)?|quer(?:y|ies)|reports?|incidents?|logs?)|Splunk\s+(?:search|alert|export|report|notable)s?|(?:Microsoft\s+)?Sentinel\s+(?:incident|alert|analytics\s+rule|query)s?|QRadar\s+(?:offense|event|log)s?|Elastic\s+Security\s+(?:alert|detection)s?|security\s+event\s+logs?|correlation\s+(?:rule|search)\s+(?:hit|alert|result)s?|notable\s+events?)\b

Corroborative evidence keywords

brute force, password spraying, lateral movement, privilege escalation, malware

Proximity: 300 characters

Should match

Microsoft Sentinel incident 4812 - multiple failed sign-ins followed by success EventID: 4625 TargetUserName: j.okafor IpAddress: 10.30.8.44 WorkstationName: FIN-LT-0231 EventID: 4624 LogonType: 10 TargetUserName: j.okafor src_ip=203.0.113.25 MITRE ATT&CK T1110.003 password spraying; analyst note: possible lateral movement from fin-lt-0231.corp.example.internal — High tier (85) - event IDs, security log fields and hosts with password spraying/lateral movement context
Splunk search export for the VPN gateway: src_ip=10.44.1.9 dest_port=443 — Medium tier (75) - log fields and IP without detection context
QRadar offense summary - EventCode: 4740 recorded on the finance domain controller. — Medium tier (75) - event ID only
The SOC shared a Splunk report on alert volumes for the quarter. — Discovery tier (65) - product wording only

Should not match

unrelated generic text without domain phrases — No relevant topic phrases present
Logging guidance note: agencies should forward Windows security event logs to the SIEM and keep them for 18 months. — Guidance text
SIEM alert template EventID: ____ src_ip= ____ TargetUserName: ____ — Blank template
Press release: the vendor added new Splunk search features to detect lateral movement, with EventID: 4624 dashboards. — News framing

Known false positives

SIEM vendor documentation, detection-engineering blogs and training labs contain sample events and field names. Mitigation: Product wording is discovery-only; enforcement needs populated event structure, and guidance/training/demo/template framing is excluded.