SIEM
A SIEM is a platform that centralises log and event data so detections can run across sources and analysts can investigate in one place.
Updated 2 Sept 2026
In more detail
Security Information and Event Management combines log collection, normalisation, correlation, alerting and retention. Its value comes from breadth: a sign-in event means little alone, but the same event alongside an EDR process alert and an unusual outbound connection becomes a credible incident. Modern deployments are usually cloud-hosted and priced by ingest volume, which makes deciding what not to collect part of the design.
Why SIEM matters
Without a SIEM, investigations happen in separate consoles with mismatched timestamps, and cross-source detections are impossible. With one, the constraint becomes data quality and rule tuning — a badly tuned SIEM buries analysts in false positives and is abandoned in favour of point tools.
How it works
Agents, syslog forwarders and cloud API connectors ship events to the platform, which parses them into a common schema and stores them for a retention window. Detection rules — threshold, correlation or behavioural — run continuously and raise alerts into a queue or ticketing system. Analysts query historical data during investigations and use dashboards for reporting.
Examples
- Correlating a failed-password burst with a later successful sign-in from a new country to flag credential stuffing.
- Alerting when a privileged group membership changes outside a change window.
- Retaining authentication logs for a year to support an investigation into earlier activity.
How it is detected or measured
SIEM health is judged by log-source coverage, parser accuracy, alert-to-incident ratio and whether detections map to the ATT&CK techniques the organisation cares about.
Where this matters
- SOC Analyst
What a SOC analyst does hour to hour, the skills that get you hired, and the realistic route from tier 1 to detection engineering.
- Security Analyst
A broader remit than the SOC: risk, controls, vulnerabilities and awareness. What the title really covers, and how to read the job advert.
Sources
- Guide to Computer Security Log Management (SP 800-92) — NIST
Log collection, normalisation and retention practice.