What is SIEM?

A SIEM ingests log streams from endpoints, network devices, servers, cloud services, identity providers, and applications, then normalizes disparate formats, syslog, CEF, LEEF, JSON, Windows Event Log XML, into a common schema so a Windows logon event and a firewall deny entry can be searched and correlated side by side. Correlation rules fire alerts when sequences of events match known attack patterns, for example a login failure spike followed by a successful authentication from an unexpected geography, or five failed VPN logins from one account followed by a successful one within a short window. Rule types range from simple threshold rules (more than N events of type X in Y minutes) to multi-stage sequence rules that chain conditions across different log sources, and statistical baseline rules that flag deviation from historical norms. Modern SIEMs add behavioral analytics (UEBA) so novel attacks without a matching rule can surface as anomalies instead of being missed entirely.

SIEMs typically include a search interface for threat hunting (Splunk SPL, Microsoft Sentinel KQL, Elastic Query DSL), dashboards for operational visibility such as a MITRE ATT&CK coverage heatmap, and a case management layer for tracking analyst work from initial alert through closure. Storage is tiered: hot storage holds recent, frequently queried data for fast search, while warm and cold tiers archive older data more cheaply to meet the multi-year retention windows PCI-DSS, HIPAA, and SOC 2 require for audit trails. Retention design is a real operational tradeoff: keeping years of raw logs in hot storage is expensive, but archiving too aggressively slows down an investigation that needs to look back six months.

Deployment models range from on-premises appliances (Splunk Enterprise, IBM QRadar) to cloud-native SaaS platforms (Microsoft Sentinel, Chronicle). Tuning is continuous: too few rules and attackers go undetected, too many rules and analysts drown in false positives. Effective SIEM management pairs good detection engineering, writing rules scoped tightly enough to fire on genuine attack patterns, with regular review of alert fidelity metrics like precision per rule.