computer science

Prelude SIEM

Prelude SIEM is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Prelude SIEM rather than just read about it. In short: Prelude SIEM is a security information and event management (SIEM) tool. Prelude SIEM is a tool for IT security that collects and centralizes information about the company's IT security to offer a single point of view to manage it.

Key takeaways

Prelude SIEM belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Prelude SIEM to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Prelude SIEM from memory before moving on to harder problems.

Reference excerpt

Prelude SIEM is a security information and event management (SIEM) tool. Prelude SIEM is a tool for IT security that collects and centralizes information about the company's IT security to offer a single point of view to manage it. It can create alerts about intrusions and security threats in the network in real-time using logs and flow analyzers. Prelude SIEM provides multiple tools for forensic reporting on big data to identify weak signals and advanced persistent threats (APTs). Prelude SIEM also includes tools for the exploitation phase to make work easier for operators and help them with risk management. While a malicious user (or software) may be able to evade the detection of a single intrusion detection system, it becomes exponentially more difficult to get around defenses when there are multiple protection mechanisms. Prelude SIEM comes with a large set of sensors, each of them monitoring different event types. Prelude SIEM permits alert collection to the WAN scale, whether its scope covers a city, a country, a continent or the world. Prelude SIEM is a SIEM system capable of inter-operating with all the systems available on the market. It implements natively with the Intrusion Detection Message Exchange Format (IDMEF, RFC 4765) format. In this way, it is natively IDMEF compatible with OpenSource IDS: AuditD, Nepenthes, NuFW, OSSEC, Pam, Samhain, Sancp, Snort, Suricata, Kismet, etc. but anyone can write their own IDS or use any of the third party sensors available, given Prelude SIEM's open APIs and libraries. Since 2016, with the "Prelude IDMEF Partner Program", Prelude SIEM is now also IDMEF compatible with many commercial IDS. Prelude SIEM provides all SIEM functions through three modules: ALERT (SEM), ANALYZE and ARCHIVE (SIM) and is so the only one true SIEM alternative on the market. Plus, Prelude SIEM promotes the use of IETF security standards through the SECEF project and the "Prelude IDMEF Partner Program".

History 1998: Creation of an IDS project by Yoann Vandoorselaere: Prelude IDS 2002: Prelude becomes a Hybrid IDS 2005: Creation of the company Prelude-Technologies 2009: The INL Society acquires Prelude-Technologies 2009: INL become Edenwall Technologies 2011-08-18: Edenwall Technologies is declared for suspended payments, Prelude-IDS software, the company, and the brand are on sale 2011-10-13: CS (Communication & Systems), Edenwall partner, buy Prelude-IDS 2012: Opening of the websites: www.prelude-ids.org and www.prelude-ids.com (Now www.prelude-siem.com) 2012: Release of the new version Prelude OSS 1.1 and Prelude Enterprise 1.1 2014: Release of Prelude Enterprise V2 2014: Prelude IDS becomes Prelude SIEM and Prelude Enterprise becomes Prelude SOC 2015: Prelude SIEM received the award of "France Cybersecurity" (French cybersecurity) 2016: Prelude SIEM launch the "Prelude IDMEF Partner Program" 2016: Prelude SIEM OSS (Community version) received the award of OW2 for its community 2017: Release of Prelude SIEM 4.0, results of two years of research and developments efforts 2017: New packaging of Prelude SIEM available: Machine virtuelle

Functions Prelude SIEM collects, normalizes, sorts, aggregates, correlates and displays all security events regardless of the types of surveillance equipment. Beyond its capacity for processing of all types of event logs (system logs, syslog, flat files, etc.), it's also natively compatible with many IDS. Prelude SIEM's main characteristics are the following:

Built on an open-source core (Python, C), light web client 2.0 "Agent-less" operation Compliant with Intrusion Detection Message Exchange Format (IDMEF, RFC 4765), Incident Object Description Exchange Format (IODEF, RFC 5070), HTTP, XML, SSL standards Smart Data: Smart correlation of security events Big Data: Collection, storage and indexing of logs Modular, flexible and resilient Hierarchical and decentralized architecture

Prelude SIEM Community version Prelude SIEM OSS has been designed in a scalable way to simply adapt to any environment. it is a free, public and open-source version (GPLV2) for small IT Infrastructures, tests and educational purposes. The open-source version is composed of the following main modules:

Manager: which receives and stores alerts into the database LibPrelude: connect each IDMEF agents to Prelude SIEM LibPreludeDB: high-speed database insertion module Correlator: event correlation module LML (Log Management Lackey): detect and normalize important logs Prewikka: web graphical user interface (GUI) These modules are the base of the ALERT module in the commercial version. The commercial version also adds many functionalities to these modules and scale up the performances and architecture possibilities.

Prelude SIEM and Prelude SOC Prelude SIEM (commercial version) is a scalable, professionally usable and high-performance version of Prelude, for real-world environments. Prelude SOC is fully scaled version, mainly for SOC (Security Operations Center) usage. The commercial versions are organized as follows:

Prelude SIEM: SIEM for enterprise with modules: ALERT, ANALYSE, and ARCHIVE ALERT: Storage, Detection, Normalization, Correlation, Aggregation, Real-time Notification ANALYSE: Analyze, Reporting and Compliance ARCHIVE: Storage, Indexation of logs and flows for forensic Prelude SOC: also to Prelude SIEM, it is possible to add more operational security modules to build a Security Operation Center (SOC) MAP: Real-time cartography of the IT parc with security indicators. It is possible to drill down and made physical, logical or risk management representations VULN: Vulnerability scanner based on OpenVAS. It is possible to use it inside the correlator to make cross-correlation ASSET: Asset management based on GLPI (assets, tickets, workflow, etc.) REPORT: Business Intelligence reporting

References

External links Official Website Prelude SIEM OSS Five questions about Prelude SIEM

Worked examples

Example 1 — a first encounter with Prelude SIEM

Start with the simplest possible case. Write down what Prelude SIEM claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Prelude SIEM before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Prelude SIEM ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Prelude SIEM

In research: Prelude SIEM appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Prelude SIEM in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Prelude SIEM is common in secondary-school and first-year university syllabi. It links to neighbouring topics Computer network security, Intrusion detection systems, Linux security software, so understanding it makes those chapters shorter.
In everyday life: Look for Prelude SIEM outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Ask Teacher Smith questions about this articleOpens your AI tutor with a question about “Prelude SIEM” →

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Prelude SIEM in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Prelude SIEM means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Prelude SIEM out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Prelude SIEM in simple terms?

Why does Prelude SIEM matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Prelude SIEM?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Prelude SIEM.