Design a SIEM system
PremiumSecurity systemMedium
- Log ingestion
- Detection rules
- Sigma rules
Quick answer
This security system interview question asks you to design a SIEM system. Aim for a design that protects users and data without blocking legitimate use, then explain the threats, controls, detection and trade-offs. Interviewers want to see how you model threats and layer defences.
The problem
Design a SIEM (security information and event management) system for a 20,000-employee company, like the log platforms security operations teams watch all day. It collects events from every source, runs detection rules and raises alerts. The hard parts are billions of events a day, detection within a minute and few enough alerts to review.
Sources include cloud audit logs, identity provider sign-ins, endpoint agents on laptops and servers, firewalls, DNS, VPN, email security and app audit logs. Each has its own format and clock. An attacker who gets in will try to stay quiet, and may try to stop or delete logs.
What must a SIEM system do?
- Ingest every source: Collect events from 40 source types over agents, syslog, cloud APIs and HTTP, without losing events during a 2-hour backlog.
- Detect fast: Run streaming rules that alert within 60 seconds of an event, plus scheduled correlation searches over longer windows.
How well must it do it?
- Detection latency: 60 seconds p95 from event time to alert for streaming rules.
- Alert budget: Alerts that reach analysts must fit the team's capacity in the numbers below.
What scale should you design for?
Use these numbers in your estimates.
The scale numbers unlock with this questionUnlock
Key concepts
- Log ingestion
- Detection rules
- Sigma rules
- Event normalisation
- Alert triage
- Stream processing
How you’ll practise
- Requirements and assets
- Threat model
- Identity and access
- Data protection
- Detection and response
- Wrap-up
Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.
What do interviewers look for?
In any security system design round.
- Starts with a clear threat model
- Layers defences instead of relying on one control
- Covers authentication, authorisation and secrets
- Plans detection, alerting and response
- Protects data in transit and at rest
- Balances security against usability and cost
Questions people ask about this interview question
- Which design type is this question?
- It is a security system question. You design a SIEM system and explain your choices the way you would in an interview.
- Is this question asked at entry level?
- It is marked Medium. Entry-level engineers can practise it, but it expects you to reason about requirements and trade-offs, not only list components.
- What should I cover first?
- Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.
- Can I practise it for free?
- It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.
Related questions
Updated · Written by the SevyDevy team