What Is a SIEM? Security Information & Event Management
A SIEM (Security Information and Event Management) is the central brain of a SOC — it collects logs from every device, correlates them, and raises alerts when patterns look like an attack. Without a SIEM, security teams drown in millions of disconnected log lines.
How a SIEM works
- Collect — ingest logs from firewalls, servers, endpoints, applications (often via syslog).
- Normalise — convert varied formats into a common structure.
- Correlate — link related events (e.g. 50 failed logins then a success = likely brute force).
- Alert — notify analysts, ranked by severity.
Why it matters
A single failed login is noise; a thousand across many accounts is an attack. The SIEM's correlation turns scattered events into meaningful detections — the core of a SOC analyst's day. Popular platforms include Splunk, Microsoft Sentinel and Elastic. This is central to the CyberOps syllabus.
Frequently asked questions
What does a SIEM do?
It collects and correlates logs from across an organisation to detect security threats and generate prioritised alerts for analysts.
What is the difference between SIEM and SOAR?
SIEM detects and alerts on threats; SOAR adds automated response — running playbooks to contain or remediate without manual steps.
What are examples of SIEM tools?
Splunk, Microsoft Sentinel, IBM QRadar and Elastic Security are widely used SIEM platforms.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.