DATABASE
SIEM Event Correlation Database Schema
A worked database example, rendered live. Open it in the AI editor and adapt it to your own case.
Make this diagram your own.
Open it in the AI editor with a prompt pre-filled — keep what works, change what doesn't.
CASE ANALYSIS
Scenario
A security information and event management (SIEM) platform needs a database to store log sources, normalized events, correlation rules, alerts, incidents, and associated assets and users.
Key decisions
- Normalizing events with foreign keys to log sources, assets, and users
- Using junction tables for many-to-many relationships between alerts and events, and incidents and alerts
When to reuse this
For any SIEM or log management system that correlates events into alerts and incidents.
Open this example in the editor →
Tweak it with chat, export PNG/SVG, or fork it for your own use case.
erd-siem-event-correlation-and-log-source-schema