Cybersecurity definition
What is SIEM?
SIEM stands for Security Information and Event Management.
By Cyber Tool Stack Editorial TeamUpdated
Definition
A central system that collects logs from across an environment, correlates them into alerts using detection rules and behavioral baselining, and lets analysts search historical activity during an investigation.
Where SIEM fits in the security landscape
These beginner lessons use this term while explaining the surrounding security control.
Related cybersecurity terms
SOCSecurity Operations CenterThe team (in-house or vendor-run) responsible for monitoring security alerts around the clock and responding when something looks like a real incident.LogA timestamped record of an event generated by a system, application, or device, used for troubleshooting and security investigation.Detection RuleLogic that turns raw log or telemetry events into a security alert when a specific suspicious pattern is matched.UEBAUser and Entity Behavior AnalyticsAnalytics that baseline what's normal for a given user or system and flag deviations from that baseline, catching suspicious activity even without a matching rule.