O cenário
A security information and event management (SIEM) platform needs a database to store log sources, normalized events, correlation rules, alerts, incidents, and associated assets and users.
O que há neste desenho
Entenda as decisões por trás dele.
01
Normalizing events with foreign keys to log sources, assets, and users
02
Using junction tables for many-to-many relationships between alerts and events, and incidents and alerts
For any SIEM or log management system that correlates events into alerts and incidents.