Design a Security Event Pipeline (SIEM)
Last updated: December 9, 2025
Quick Overview
Design a system that ingests, normalizes, correlates, and alerts on security events from thousands of cloud accounts in real time with sub-minute alerting for critical findings.
Wiz
December 9, 20258
6
2,071 solved
Design a system that ingests, normalizes, correlates, and alerts on security events from thousands of cloud accounts in real time with sub-minute alerting for critical findings.
Security event pipelines at Wiz must handle massive volumes of cloud events while maintaining low latency for critical alerts. The system must normalize events from different cloud providers into a common format, correlate related events, and generate actionable alerts without overwhelming security teams with noise.
What the Interviewer Expects
- Design an event ingestion layer that handles burst traffic from thousands of accounts
- Implement event normalization across different cloud provider formats
- Build a correlation engine that detects multi-step attack patterns
- Address deduplication, noise reduction, and alert fatigue
- Ensure sub-minute end-to-end latency for critical security events
Key Topics to Cover
How to Approach This
- Start by clarifying functional and non-functional requirements with the interviewer.
- Estimate the scale: QPS, storage, bandwidth. This drives your design decisions.
- Draw a high-level architecture first, then deep dive into 1-2 critical components.
- Discuss trade-offs explicitly (e.g., consistency vs availability, SQL vs NoSQL).
- Address failure scenarios, monitoring, and how the system handles 10x traffic spikes.
Possible Follow-up Questions
- How would you handle a sudden 10x spike in events from one tenant?
- How do you avoid alert fatigue while ensuring critical events are never missed?
- What storage strategy would you use for event retention and forensic analysis?
- How would you add a new cloud provider's event format with minimal disruption?
Sharpen Your Skills on Codemia
Practice similar problems with our interactive workspace, get AI feedback, and track your progress.
Practice System Design ProblemsSample Answer
Requirements
Functional Requirements
- Event Ingestion: The system must ingest security events from thousands of cloud accounts in real-time, including AWS CloudTrail logs, Azure Security Center alerts, a...
Capacity Estimation
Assuming each cloud account generates approximately 100 security events per second:
- Number of Accounts: 10,000
- Estimated Events per Second: 10,000 accounts * 100 events/account = **1,000,0...
Submit Your Answer
