Security information and event management (SIEM) is software that collects log and event data from across your IT environment, such as firewalls, endpoints, identity systems, servers and cloud services, and puts it in one place. It normalizes the data, correlates events from different sources to detect suspicious activity, raises alerts for analysts to investigate, and keeps logs for investigations and compliance reporting. SIEM is commonly the central tool of a security operations center (SOC).
At a glance
- A SIEM collects and stores security logs from many sources in one searchable place.
- Correlation rules and analytics spot patterns that no single tool would see, such as a login from a new country followed by a large file download.
- It supports investigations and compliance reporting, and keeps logs for a set retention period.
- It is usually priced by data volume or source count, so costs grow with your environment.
- It needs skilled people to tune and monitor it, which is why many companies buy it as a managed service.
What problem it solves
Every security tool produces its own logs and alerts in its own console. When something goes wrong, an investigator has to piece together what happened from firewall logs, email logs, identity logs and endpoint alerts, often while the attack is still in progress. Some attacks only become visible when events from several systems are seen together.
Regulations, auditors, customers and cyber insurers also expect companies to collect security logs centrally, keep them for a defined period and be able to show who accessed what. A SIEM brings logs together, applies detection across all of them and keeps the record.
How it works
Collection. The SIEM receives data from sources through agents, syslog forwarding, and API connectors for cloud and SaaS services. Common sources include firewalls, identity providers, endpoint detection tools, email security, servers and cloud platforms.
Normalization and enrichment. Different log formats are mapped to a common structure so they can be searched and compared. Events are often enriched with context such as user details, asset information and threat intelligence.
Detection. Correlation rules and analytics look for patterns that indicate an attack. Many platforms map detections to frameworks such as MITRE ATT&CK and add behavioral analytics (often called UEBA, user and entity behavior analytics) that flag unusual activity for a user or device. Rules need ongoing tuning to reduce false positives.
Investigation and response. Analysts review alerts, search across all collected data and build a timeline. Many SIEMs integrate with or include SOAR features to automate routine steps.
Retention and reporting. Logs are kept for a set period, often with recent data in fast storage and older data archived. Built-in reports and dashboards support audits.
SIEMs are now mostly delivered as cloud services, though on-premises deployments remain.
When it matters for buyers
- When a compliance requirement calls for centralized logging. Frameworks and regulations commonly require log collection, monitoring and retention.
- When an insurer or customer asks about monitoring. Questionnaires often ask whether logs are monitored around the clock.
- When the SIEM contract renews or costs spike. Growing data volumes are a common reason to renegotiate or switch.
- When deciding between building a SOC and buying MDR. The SIEM is the biggest tool decision in that choice.
- After an incident where nobody could reconstruct what happened. Missing logs are a common finding.
Questions to ask vendors
- How is pricing calculated (data volume, sources, users), and what happens if volumes spike?
- Which of our sources have prebuilt connectors, and what does it take to add a custom one?
- How much detection content is included, and how often is it updated?
- How long is data kept in searchable storage, and what does longer retention cost?
- Are SOAR, UEBA and threat intelligence included or extra?
- Can a managed provider run it for us on a co-managed basis, and who owns the data if we leave?
- How do we export our data if we change platforms?
How it differs from XDR and MDR
Extended detection and response (XDR) is detection and response built around a vendor’s own security tools, often starting from endpoint data, with tighter integration but usually fewer third-party sources than a SIEM. Managed detection and response (MDR) is a service: people who monitor and respond for you, using their own platform or yours. A SIEM is the platform; MDR is the team. For use cases, tuning and costs, see our SIEM guide and MDR vs SIEM.
Problems this helps with
- Security logs scattered across too many tools to investigate an incident
- Auditors asking for centralized logging and log retention
- SIEM costs rising with every new data source
- Too many alerts and not enough people to review them
