<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>Siem on Bill's Blog</title><link>https://billsblog.dev/tags/siem/</link><description>Recent content in Siem on Bill's Blog</description><image><title>Bill's Blog</title><url>https://billsblog.dev/images/og-card.jpg</url><link>https://billsblog.dev/images/og-card.jpg</link></image><generator>Hugo</generator><language>en-AU</language><lastBuildDate>Sun, 19 Jul 2026 11:45:00 +1000</lastBuildDate><atom:link href="https://billsblog.dev/tags/siem/index.xml" rel="self" type="application/rss+xml"/><item><title>Building a Homelab SIEM with Loki — Reading My Logs Instead of Hoping</title><link>https://billsblog.dev/posts/homelab-siem-loki/</link><pubDate>Sun, 19 Jul 2026 11:45:00 +1000</pubDate><guid>https://billsblog.dev/posts/homelab-siem-loki/</guid><description>I had metrics but no logs. How I centralised my firewall and server logs into one searchable place, using Loki instead of Splunk — and the messy real-world problems I hit doing it.</description></item></channel></rss>