A SIEM collects logs from many systems and correlates events so analysts can see patterns that one console would otherwise miss.
Its job is gathering, storing, and relating evidence, while a different product family orchestrates the response actions.
How it works
Sources include sign in systems, firewalls, endpoints, and applications.
Rules and searches raise alerts when events line up, such as a new admin account followed by unusual data access.
A full archive without questions is just storage.
Analysts need detections tied to real abuse, retention that meets the investigation, and a handoff when an alert deserves the incident process or an automated playbook elsewhere.
Concrete examples
- Failed desktop logons from many countries appear beside a successful sign in an hour later.
- A firewall allow and an application export land in one case because they share the same account.
- A quiet log source is noticed because the daily volume dropped to zero after an agent stopped.
Protective measures
- Send the logs you would need in a breach, and drop noise that nobody will ever search.
- Write detections for concrete stories and review them when attackers change pretexts.
- Keep the archive on systems the monitored hosts cannot edit, with a retention period you can explain.
- Hand confirmed cases to responders or to an orchestration playbook instead of leaving them in a queue.
Related articles
What is SOAR? explains orchestration of response steps, which starts where collection and correlation leave off.
What is a security operations center? explains the human monitoring function that investigates what this system raises.
What is security incident response? explains the handling process that should receive cases once correlation shows likely harm.