## SIEM Architecture Deep Dive

Welcome to the big leagues. In Path 3, we treated the SIEM as a black box that just "works". In Advanced SOC roles, you need to know *how* it works, because you will be the one fixing it when it breaks.

### The Pipeline of Data
A typical Enterprise SIEM (like Splunk or ELK) has a distributed architecture.

1.  **Generation**: The endpoint (Windows) or device (Firewall) creates the log.
2.  **Collection (The Edge)**:
    *   **Universal Forwarder (Splunk) / Beats (Elastic)**: Small agents on the endpoint.
    *   **Syslog Server**: A Linux box acting as a funnel for network devices.
    *   *Bottleneck Risk*: If the Syslog server disk fills up, you lose firewall logs instantly.
3.  **Aggregation (The Middleman)**:
    *   **Heavy Forwarder (Splunk) / Logstash**: Intermediate servers that parse, filter, and mask data (e.g., removing Credit Card numbers) *before* sending it to the core.
    *   *Why?* To save bandwidth and CPU on the main indexers.
4.  **Indexing (The Core)**:
    *   **Indexers**: The heavy lifters. They write the data to disk.
    *   *Clustering*: Data is replicated across multiple indexers for High Availability.
5.  **Search Head (The User Interface)**:
    *   This is what you log into. It doesn't store data. It distributes your query to the Indexers, merges the results, and shows you the graph.

### Hot, Warm, Cold Buckets
Storage is expensive. We can't keep petabytes on SSDs.
*   **Hot Bucket**: Data arriving *right now*. Stored on NVMe SSDs for instant search. (Retained: ~7 days).
*   **Warm Bucket**: Data from last week. Read-only. Stored on SSDs. (Retained: ~30 days).
*   **Cold Bucket**: Data from last month. Moved to cheaper HDDs. Slower to search. (Retained: ~1 year).
*   **Frozen**: Data archived to Amazon S3 Glacier (Tape). Unsearchable unless you "thaw" it. (Retained: 5-7 years for legal).

### EPS (Events Per Second) Sizing
*   **Scenario**: A firewall sends 10,000 logs/second.
*   **Math**: 10k EPS * 500 bytes/log = 5 MB/second = 432 GB/day.
*   **Impact**: Can your Indexer write 5 MB/s continuously while *also* answering search queries? If not, you need more hardware.