Centralized Logging & SIEM Integration

After hardening firewalls and deploying intrusion detection, the next pillar is visibility. A single compromised host can hide its tracks by editing local logs.

Centralized logging ships every event off the box to a dedicated collector, so attackers cannot easily erase evidence.

• Tamper resistance
• Correlation across many servers
• Long-term retention for forensics

Modern distros use systemd-journald for structured logs and rsyslog for forwarding.

You inspect the journal with journalctl and configure forwarding rules in /etc/rsyslog.conf or drop-in files under /etc/rsyslog.d/.

A SIEM (Security Information and Event Management) platform ingests logs, normalizes them, and runs correlation rules to surface threats.

Popular options include the Elastic Stack (ELK), Wazuh, Graylog, and Splunk.

• Ingest: collect raw events
• Parse: extract fields
• Correlate: link related events
• Alert: notify on suspicious patterns

To send all logs to a central collector over TCP, add a forwarding rule. The double @@ means TCP (single @ is UDP).

Plaintext syslog over the network leaks sensitive data. Use TLS with the rsyslog GnuTLS module so logs are encrypted in transit.

In an Elastic Stack setup, Filebeat tails files and ships them to Logstash or Elasticsearch. It tracks read position so no events are lost on restart.

Raw logs are messy. A SIEM applies parsers (Logstash grok, Wazuh decoders) to turn a line into fields like src_ip, user, and action.

Normalized fields let you write rules that work across SSH, firewall, and web logs uniformly.

The real power of a SIEM is correlation: combining low-value events into a high-value alert.

• 5 failed SSH logins in 60s from one IP, then a success = possible brute force success
• Firewall drop spike + new outbound connection = possible exfiltration

Feed your existing intrusion detection alerts (Suricata, Snort, Fail2ban, AIDE) into the same SIEM.

Now a single dashboard shows firewall drops, IDS signatures, and audit findings side by side, enabling cross-source correlation.

Detection without notification is useless. Configure the SIEM to push alerts to email, Slack, or a ticketing system.

Mature teams add SOAR playbooks that auto-respond, for example dynamically adding an iptables drop rule for a flagged IP.

Logs are evidence. Protect them:

• Append-only or WORM storage
• Define retention to meet compliance (PCI, GDPR)
• Hash log archives so tampering is detectable

Why is centralized logging preferred over relying only on local log files?

You learned to turn raw server logs into security intelligence:

• Ship logs centrally with rsyslog/Filebeat over TLS
• Parse and normalize into fields
• Correlate across firewall, IDPS, and audit sources in a SIEM
• Alert, respond, and protect log integrity

Centralized logging completes the hardening loop: prevent, detect, and now observe.