## Module 22 Review
You have completed the SIEM Fundamentals module. You should now understand:
1.  **Aggregation, Normalization, Correlation**.
2.  The difference between **Syslog** vs **Agent** ingestion.
3.  How to read a normalized log vs a raw log.
4.  The landscape of tools: Splunk, Sentinel, ELK, Wazuh.

Proceed to the next module to apply this knowledge in practical Use Cases.