SIEM (security information and event management)
security information and event management · log management · log correlation · event correlation · SOAR
A tool that centralises logs from across the information system, correlates them and raises an alert when a combination of events gives an attack away.
In practice
A single event, such as a failed login, says little; ten thousand failures followed by a success from abroad tell the story of an attack. The SIEM applies correlation rules, keeps history for investigations and feeds the SOC’s dashboards. Its value depends on the sources connected and the quality of its rules: badly tuned, it drowns analysts in false positives. Logs must be reliably time-stamped and protected against deletion.
Fictional case: a local authority’s SIEM correlates three weak signals: a VPN login at 2 a.m., unusual access to the HR file share, then an abnormal volume of outgoing data. Taken one by one, none of them would have raised an alert.
