Cybersecurity glossary
What is Security Information and Event Management (SIEM)?
Learn what a SIEM is, how it centralizes logs for search, correlation, and compliance, where it differs from EDR, XDR, and SOAR, and what makes a SIEM program actually detect attacks.
Definition
Security Information and Event Management (SIEM) is a platform that collects, normalizes, stores, and analyzes security and operational logs from many sources so teams can search history, correlate events, generate alerts, and support investigations and compliance reporting.
Why scattered consoles are not a detection program
Every security product keeps its own history. Attackers cross those products. A SIEM is the common room: identity, cloud audit, WAF, EDR summaries, and application events in one query language, with retention that outlives a vendor’s default 30-day console.
The platform is infrastructure. The detections are the control.
What a SIEM is for
Collect and normalize
Ship logs, parse them into a stable schema, and drop or redact what has no investigative value.
Search and hunt
Answer “has this token, hash, or user appeared before?” across weeks, not only the last alert.
Correlate and alert
Turn multi-source hypotheses into cases the SOC can work, with severity and context.
Report and retain
Prove access reviews, privileged activity, and incident timelines to auditors without screenshots.
A SIEM that detects, not just stores
Pick priority use cases
Start with credential abuse, privileged change, and data-export anomalies—not 400 vendor rules.
Prove the telemetry
Each use case lists required sources, fields, and a health check if the feed dies.
Build owned content
Detections in version control, mapped to ATT&CK, with runbooks.
Tune against reality
Measure true positives per rule; disable or rewrite the noisiest offenders monthly.
Close the loop
Incidents and purple tests spawn new analytics; unused indexes get dropped to control cost.
SIEM beside EDR, XDR, and SOAR
| Capability | SIEM contribution | Do not expect the SIEM to |
|---|---|---|
| EDR | Long-term search of forwarded endpoint events | Replace host isolation and deep process trees |
| XDR | Hold sources the XDR will never parse | Always lose the investigation UX contest |
| SOAR | Provide the alert that kicks a playbook | Automate response by itself |
| Compliance | Retain attributable admin and access events | Satisfy audits if parsers never captured the actor |
- Define an ingestion allowlist by use case; refuse “send everything” as a strategy.
- Alert when a critical source goes silent or parse-error rate spikes.
- Keep a detection backlog with owners; default vendor rules are a starting draft.
- Separate hot investigation storage from cheap archive with a tested restore path.
- Redact secrets at ingest; a SIEM full of tokens is a breach waiting for a query.
- Integrate tickets so every paged alert has a case, not a screenshot in chat.
- Review cost per GB against detections that actually fired true positives.
- Test that responders can still query 60-day-old identity events during a drill.
The practical takeaway
A SIEM is centralized, searchable security history plus the detections you are willing to own. Collect the logs that investigations need, correlate with intent, and treat unused noisy rules as technical debt—not coverage.
Related security terms
Log Correlation
Core analytic technique SIEMs apply across ingested sources.
Detection Engineering
Discipline that keeps SIEM content accurate and owned.
Security Orchestration, Automation and Response (SOAR)
Automation layer that often consumes SIEM alerts.
Audit Log
High-value events a SIEM should retain with integrity.
Alert Fatigue
The human cost of an untuned SIEM rule pack.
Frequently asked questions
What is a SIEM in simple terms?
It is a searchable warehouse for security logs plus the rules and dashboards that turn those logs into alerts and investigation timelines.
Is a SIEM the same as log management?
Log management stores and searches. A SIEM adds correlation, alerting, use-case content, and usually role-based access suited to security operations and audits.
Does buying a SIEM mean you are monitoring?
No. Ingestion without parsers, detections, owners, and on-call is expensive storage. Detection engineering is what makes the platform a control.
How does SIEM compare with XDR?
SIEMs aim to ingest anything and keep it for a long time. XDR usually correlates a tighter set of sensors with a guided incident UX. Many programs run both with a clear split of duties.
What logs should go in first?
Identity (IdP, VPN, privileged access), endpoint/EDR summaries, email security, cloud audit, firewall/WAF, and your own application audit events—not every debug line from every microservice on day one.
How long should SIEM data be kept?
Hot search long enough for investigations (often 90 days or more) plus cheaper archive for compliance. Retention without queryability does not help responders.
Why do SIEM projects stall?
Unbounded ingestion costs, unowned default rules, and no telemetry quality checks. Success looks like a small set of high-fidelity use cases that actually page humans.
References
Explore authoritative guidance and frameworks related to security information and event management (siem).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.