Full Definition
What is SIEM?
Security Information and Event Management (SIEM) combines Security Information Management (SIM) and Security Event Management (SEM) into a unified platform. SIEM solutions collect and analyze log data from across an organization's infrastructure to detect security threats, ensure compliance, and support incident response.
Core Functions
Log Collection
- Centralized log aggregation
- Multi-source ingestion
- Normalization and parsing
Correlation
- Pattern detection
- Cross-source analysis
- Rule-based correlation
Alerting
- Real-time notifications
- Severity classification
- Escalation workflows
Investigation
- Search and query
- Timeline analysis
- Forensic capabilities
Reporting
- Compliance reports
- Dashboards
- Trend analysis
Data Sources
- Firewalls and IDS/IPS
- Endpoints and servers
- Cloud services
- Applications
- Identity systems
- Network devices
Use Cases
- Threat detection
- Incident investigation
- Compliance monitoring
- Insider threat detection
- Security operations
Modern SIEM Features
- User and Entity Behavior Analytics (UEBA)
- Security Orchestration (SOAR)
- Machine learning detection
- Cloud-native architecture
- Extended detection (XDR)
Popular SIEM Solutions
- Splunk
- Microsoft Sentinel
- IBM QRadar
- Elastic Security
- Sumo Logic