SIEM
noun · also Security information and event management
A platform that collects logs from across an organization, correlates them and raises alerts, giving the SOC one place to investigate.
A security information and event management (SIEM) system ingests logs from identity providers, endpoints, firewalls, email, cloud services and applications, stores them centrally and runs detection rules over them. When a rule matches, the SIEM creates an alert or incident for the SOC to work.
The value is correlation: a failed sign-in, a new inbox rule and an unusual file download mean little in isolation, but together in one timeline they tell the story of a compromised account.
Example
Microsoft Sentinel, Splunk Enterprise Security and Google Security Operations are widely used SIEMs. In Sentinel, a scheduled analytics rule written in KQL runs every hour, looks for many failed sign-ins followed by a success from the same IP, and opens an incident when it finds one.
Why it matters for a SOC analyst
The SIEM is where most of your day happens: triaging incidents, querying logs during investigations and tuning rules that are too noisy. Knowing which data sources are connected, and which are not, is as important as knowing the query language, because a detection can only see the logs that actually arrive.
Articles that use this term
Certifications · · 3 min read
SC-200 study plan for SOC beginners
A six-week plan to prepare for Microsoft's Security Operations Analyst exam: what to study each week, how to practice for free, and the KQL you need to know.
Related terms
- KQL
The read-only query language used by Microsoft Sentinel, Defender XDR advanced hunting, Azure Monitor and Azure Data Explorer.
- SOAR
Tools that connect security products and run automated playbooks, so routine response steps happen in seconds instead of being done by hand.
- XDR
A security platform that correlates detections from endpoints, identities, email, cloud apps and more into single incidents with a shared response console.
- Security operations center
The team, processes and tools that monitor an organization around the clock, investigate alerts and coordinate the response to incidents.
- EDR
Security software on laptops and servers that records process, file and network activity, detects malicious behavior and lets analysts respond.
- Indicator of compromise
An observable artifact, such as a file hash, IP address, domain or registry key, that suggests a system may have been compromised.