What is SIEM?

A SIEM ingests log streams from endpoints, network devices, servers, cloud services, identity providers, and applications, then normalizes disparate formats into a common schema. Correlation rules fire alerts when sequences of events match known attack patterns. For example, a login failure spike followed by a successful authentication from an unexpected geography. Modern SIEMs add behavioral analytics (UEBA) so novel attacks without a matching rule can surface as anomalies.

SIEMs typically include a search interface for threat hunting, dashboards for operational visibility, and a case management layer for tracking analyst work. They also serve as the long-term log repository required by PCI-DSS, HIPAA, and SOC 2, which mandate multi-year retention and audit trails.

Deployment models range from on-premises appliances (Splunk Enterprise, IBM QRadar) to cloud-native SaaS platforms (Microsoft Sentinel, Chronicle). Tuning is continuous: too few rules and attackers go undetected. Too many rules and analysts drown in false positives. Effective SIEM management pairs good detection engineering with regular review of alert fidelity metrics.