Security information and event management (SIEM) is a system that collects logs and security events from across an organization, correlates them and raises alerts about possible attacks.
How SIEM works
The term was introduced by Gartner in 2005 as a combination of security information management (log storage and reporting) and security event management (real-time monitoring). A SIEM:
- ingests logs from servers, workstations, firewalls, VPN, cloud services, identity providers and applications;
- normalizes them into a common format and stores them for search and investigations;
- applies correlation rules – for example “many failed logins followed by a success from a new country” – and generates alerts;
- provides dashboards and reports for compliance.
Well-known products include Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security and Google Security Operations. Detection rules are often shared in the vendor-neutral Sigma format.
Why SIEM matters for security
Individual logs rarely reveal an attack; the pattern across many systems does. The SIEM is the central tool of a SOC and the main source of evidence for incident response. Many regulations and standards – PCI DSS, ISO 27001, NIS2 – require central logging and log retention. The challenges are cost, which often grows with data volume, and the constant tuning needed to avoid floods of false alerts.
Best practices
- Start with high-value sources: identity, EDR, VPN, email, internet-facing systems.
- Keep logs long enough – attackers are often discovered months after entry.
- Map detections to MITRE ATT&CK and test them; enrich alerts with indicators of compromise.
- Combine SIEM with SOAR playbooks to automate routine response.
