SIEM (Security Information and Event Management)
SIEM is a log-centric security technology focused on collection, normalizing and storing log data (event data) from security devices, servers, applications, and other infrastructure components.
What it provides
- Log aggregation & retention - It centralizes vast volumes of raw logs (firewall logs, authentication events, application logs) in a searchable repository, often with compliance-driven (use a industry standard) retention schedules (how long you keep the type of logs).
- Correlation & rule-based alerts - Predefined or custom rules thoroughly examine those logs to identify known indicators of compromise. Like, “more than 10 failed logins in five mins followed by a successful admin login”, this could fire an alert. Alerts are made when rule conditions are met.
- Dashboards & Reporting - Analysts get visual summaries of security postures, compliance status (whether your environment meets specific legal/industry standards), and trending anomalies, enabling them to spot unusual spikes or patterns over time.