Dictionary · Defensive Security
SIEM
SIEM — Security Information and Event Management
Detection · Intermediate
A platform that collects logs from many systems, correlates events, and helps analysts search and alert. It is only as useful as the logs and the detections you feed it.
Instead of logging in to every server, analysts search one place. Correlation can connect a failed login on a firewall with a new process on a laptop.
Example: A search across firewall, identity, and endpoint logs shows the same account failing remotely and then succeeding from an unusual country.
Common misconception
- Buying the platform does not create detections. Use cases, time sync, and log sources still have to be designed.