SIEM

A SIEM (security information and event management) is software that collects logs and events from across an organization, stores them in one place and looks for signs of an attack. Servers, laptops, the firewall, the VPN, cloud accounts, email and identity systems all write records of what happens: who logged in, from where, which file was opened, which connection was blocked. On its own, each record says little. Put together, they can tell a story.

The SIEM first normalizes the data, so a login looks the same whether it came from Windows, a Linux server or a cloud service. Then it correlates: it applies detection rules that combine events across sources and time. "Fifty failed logins followed by a success from a new country" or "an admin account created at 3 a.m. and then used to export a database" are typical rules. When one matches, it raises an alert for an analyst, usually in a security operations center.

It is also the organization's memory. During an investigation, analysts search months of logs to reconstruct what an attacker did, and auditors ask for proof that access is monitored, which is why regulations often push companies toward one. The hard part is tuning: a SIEM with too many noisy rules buries real attacks under thousands of false alarms, and one with too few misses them. Modern products add behavior analytics, threat intelligence feeds and automated responses, and many now run as a cloud service.