Design SIEM System - System Design | WinJob

Problem Statement and SIEM Mission

Define a multi-tenant SIEM that ingests heterogeneous security telemetry, normalizes to a canonical schema, correlates in near real time, and drives SOC workflows with auditable retention tiers.

Design anchors (1)

Separate collection (agents, syslog, cloud APIs) from analytics (search, correlation, UEBA) so ingest spikes never stall investigations.
Treat false-positive budget as an SLO: tier-1 alerts must stay below analyst capacity; everything else queues or auto-suppresses.
Never index raw secrets—tokenize PAN, hash credentials, and route compliance copies to WORM storage.

Mechanism

Sources ship events to partitioned Kafka topics by tenant and source type. Stream parsers map to ECS/OCSF-like fields, enrich with asset and identity graph lookups, then fan out to hot columnar store for 90-day search and cold object tier for multi-year forensics.

Failure drills

If Kafka lag exceeds 120s, throttle low-value sources, scale parser HPA, and page platform—not SOC. If OpenSearch bulk rejects spike, rollover read-only indices and shed warm shards. If rule promotion fails validation, keep prior version active and open Sev2 to detection engineering. If enrichment cache (Redis) is cold, fall back to stale asset graph with enrichment_stale=true flag on alerts.

Cost and capacity

At 2.5M /s Peak EPS, right-size parsers before indexers—CPU on regex and JSON dominates. Chargeback tenants on ingested GB after compression.

Signal	Target
Peak EPS	2.5M /s
Hot retention	90 days
MTTD target	15 min
Analyst seats	400

javaOne Dark Pro

1 public record NormalizedEvent(String tenantId, String eventClass, Instant ts, String actorId) {
2   public String partitionKey() { return tenantId + ":" + eventClass; }
3 }

pythonOne Dark Pro

1 def should_suppress(fingerprint: str, seen: dict[str, float], now: float, ttl: float = 3600) -> bool:
2     last = seen.get(fingerprint)
3     if last and now - last < ttl:
4         return True
5     seen[fingerprint] = now
6     return False

typescriptOne Dark Pro

1 export interface CorrelationHit {
2   ruleId: string;
3   severity: number;
4   entities: string[];
5 }
6  
7 export function fingerprint(ruleId: string, entities: string[]): string {
8   return ruleId + ":" + entities.sort().join("|");
9 }

Why interviewers care

SIEM System interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement and SIEM Mission that proves you understand real outages, not happy-path diagrams.

Key Highlights

•Define a multi-tenant SIEM that ingests heterogeneous security telemetry, normal
•Metrics: Peak EPS, Hot retention, MTTD target, Analyst seats
•Separate collection (agents, syslog, cloud APIs) from analytics (searc

1	public record NormalizedEvent(String tenantId, String eventClass, Instant ts, String actorId) {
2	public String partitionKey() { return tenantId + ":" + eventClass; }
3	}

1	def should_suppress(fingerprint: str, seen: dict[str, float], now: float, ttl: float = 3600) -> bool:
2	last = seen.get(fingerprint)
3	if last and now - last < ttl:
4	return True
5	seen[fingerprint] = now
6	return False

1	export interface CorrelationHit {
2	ruleId: string;
3	severity: number;
4	entities: string[];
5	}
6
7	export function fingerprint(ruleId: string, entities: string[]): string {
8	return ruleId + ":" + entities.sort().join("\|");
9	}