In a company, firewalls, servers, endpoints, cloud services, and applications constantly generate log data. Viewed individually, these entries often say little. Only in context does it become apparent that, for example, an unusual sign-in, a new forwarding rule in a mailbox, and a large data outflow belong to the same attack. A SIEM is designed precisely for this combined view.
How does a SIEM work?
A SIEM performs several tasks:
- Collect: Log data from different sources is stored centrally.
- Normalize: The data is converted into a uniform format so that it is comparable.
- Correlate: Rules and analyses link events across systems and recognize patterns, such as many failed sign-ins followed by a successful one.
- Alert: Anomalies are reported to the responsible team as alerts.
- Retain and analyze: Logs are available for investigations, reports, and evidence.
Many modern SIEM solutions run in the cloud and use behavioral analytics in addition to fixed rules. They are often combined with SOAR functions (security orchestration, automation, and response) that automate recurring responses, for example temporarily locking an account.
Typical examples
- A sign-in from an unusual country a few minutes after a sign-in at the office triggers an alert.
- After an incident, the team uses the collected logs to reconstruct when and how the attackers got into the network.
- For audits according to ISO/IEC 27001 or for NIS2 requirements, logging and analysis are demonstrated.
What companies should keep in mind
- Start with clearly defined use cases instead of collecting as much data as possible.
- Connect the most important sources first, such as identities, email, firewall, EDR, and servers.
- Plan costs for data volumes and retention realistically.
- Define responsibilities for alerts, because without staff who respond, a SIEM achieves little. An external security operations center can also take on this task.
- Observe data protection, as logs often contain personal data.
How it differs
IT monitoring primarily monitors the availability and performance of systems, such as whether a server is reachable or a hard drive is filling up. A SIEM, by contrast, evaluates events from a security perspective.
View security services