Security Information and Event Management (SIEM)
Security information and event management (SIEM) is software that collects, centralizes, and analyzes log data from across an organization's systems to detect activity that could be a security event or incident, and alerts the security team.
Updated
Overview
An organization's network contains devices, applications, operating systems, and cloud services, and each of them can generate log data. A SIEM gathers that dispersed log data and consolidates it into reports and dashboards. NIST describes it as a program that provides centralized logging for a variety of log types.
A SIEM analyzes the collected data with rules and filters to detect anomalous activity that could represent a security event or incident. Many SIEM products add up-to-date cyber threat intelligence from external sources to this analysis. When the SIEM detects a potential event or incident, it generates an alert for the security team to investigate and respond to.
A SIEM needs ongoing maintenance. Alerts need regular tuning to improve detection and reduce false alarms, and implementing the platform usually takes several people working on it full time. Most SIEM pricing models are based on the quantity of data the SIEM ingests, and organizations commonly feed it more log data over time to improve visibility and detection.
Similar Terms
1 termFrequently Asked Questions
What does SIEM stand for?→
SIEM stands for security information and event management.
What is the difference between SIEM and SOAR?→
A SIEM collects, centralizes, and analyzes log data and generates alerts when it detects a potential security event or incident. A SOAR builds on that analysis and automates some of the response by running predefined playbooks, such as isolating the source of an event in the network.
How is a SIEM priced?→
Most SIEM pricing models are based on the quantity of data the SIEM ingests, so the amount of log data sent to it drives the cost. Some products cap ingestion at a set volume.
Related
Sources
Definitions follow the government and standards body sources listed above. This site is not affiliated with the agencies or organizations cited.