Security Information and Event Management (SIEM)

A Security Information and Event Management platform aggregates log and event data from across the environment: firewalls, servers, endpoints, applications, and sensors such as an intrusion detection system. It normalises those feeds into a common format, stores them centrally, and applies correlation rules that connect individual events into patterns worth an analyst’s attention, producing alerts and dashboards from what would otherwise be millions of unread log lines.

Correlation across sources is the differentiator. Any log server can store events; a SIEM notices that a failed VPN login, a new administrator account, and an unusual outbound transfer flagged by egress monitoring belong to the same story. That power carries an operational cost: correlation rules must be tuned to the environment, and an untuned SIEM buries analysts in false positives until alert fatigue sets in and real incidents get dismissed along with the noise.

Exam relevance: if a scenario mentions correlating events from multiple sources, centralised log analysis, or a single pane of glass for detection, the answer is SIEM. Contrast it with the IDS, which inspects one traffic stream or host and alerts on it alone; the SIEM is where those alerts, and everything else, are brought together. Questions about analysts ignoring alerts point to tuning and alert fatigue, a SIEM management failure rather than a technology failure.