Security information and event management (SIEM)
- Term
- Security information and event management (SIEM)
- Exam
- CISA & CISM
- Definition
A system that collects and correlates logs from many sources to detect incidents.
- Explained
A SIEM collects and correlates logs from many sources to detect incidents. Its value depends on complete log sources, tuned detection use cases and a process for investigating alerts.
- In practice
Failed logins from many countries for one account trigger a correlated alert.
- Often confused with
- Log storage
- Exam angle
Value depends on tuned use cases and an investigation process.
- Related