Glossary
SIEM
A SIEM is a platform that centralises log and event data so detections can run across sources and analysts can investigate in one place.
Updated 2 Sept 2026
In detail
Security Information and Event Management combines log collection, normalisation, correlation, alerting and retention. Its value comes from breadth: a sign-in event means little alone, but the same event alongside an EDR process alert and an unusual outbound connection becomes a credible incident. Modern deployments are usually cloud-hosted and priced by ingest volume, which makes deciding what not to collect part of the design.
Why it matters
Without a SIEM, investigations happen in separate consoles with mismatched timestamps, and cross-source detections are impossible. With one, the constraint becomes data quality and rule tuning — a badly tuned SIEM buries analysts in false positives and is abandoned in favour of point tools.
Examples
- Correlating a failed-password burst with a later successful sign-in from a new country to flag credential stuffing.
- Alerting when a privileged group membership changes outside a change window.
- Retaining authentication logs for a year to support an investigation into earlier activity.