SIEM (Security Information and Event Management)

SIEM — security information and event management — is the platform where an organization's security telemetry comes together. Logs and events from endpoints, servers, identity providers, email gateways, cloud services, and network devices stream into one system, which normalizes them, correlates them against detection rules, and raises alerts for analysts to triage. If the security operations center is the team, the SIEM is its central nervous system: the place where a login from a new country, a mailbox rule change, and a password reset stop being three unrelated log lines and become one story.

How it works

A SIEM ingests events in enormous volume, then applies correlation rules, threat-intelligence matches, and increasingly behavioral analytics to separate signal from noise. A single failed login means nothing; two hundred failed logins across fifty accounts from one IP address is a password-spraying alert. Alerts are scored and queued, analysts investigate the ones that matter, and the same stored data later answers the forensic questions — what did the attacker touch, when, and from where — that determine an incident's scope and dwell time. Retained logs also do compliance duty, providing the audit trail frameworks like ISO 27001, PCI DSS, and NIS2 expect.

How to defend with it

A SIEM is only as good as what feeds it and who reads it. Two human factors decide most of its value. The first is alert fatigue: badly tuned rules bury analysts in false positives until real alerts are dismissed with the noise, so rule tuning and alert hygiene are security controls in their own right. The second is the human sensor network — some of the highest-value events a SIEM can receive are employee reports of suspicious messages and calls, which often precede any technical indicator. Feeding those reports into the same correlation pipeline, and building the reporting culture that produces them, turns the workforce into the one log source attackers cannot disable. Social-engineering signals — impossible-travel logins after a vishing call, OAuth grants after a consent-phishing email — belong in the detection rules alongside malware indicators, a point our guide to incident response for social engineering develops further.