# SIEM

> The system that gathers security logs from everywhere and raises the alarm.

- Level: Advanced
- Topics: Security
- URL: https://tidbit.legios.com.ar/siem/
- In Spanish: [SIEM](https://tidbit.legios.com.ar/es/siem/)

A **SIEM** (security information and event management) is software that collects logs and events from across an organization, stores them in one place and looks for signs of an attack. Servers, laptops, the firewall, the VPN, cloud accounts, email and identity systems all write records of what happens: who logged in, from where, which file was opened, which connection was blocked. On its own, each record says little. Put together, they can tell a story.

The SIEM first **normalizes** the data, so a login looks the same whether it came from Windows, a Linux server or a cloud service. Then it **correlates**: it applies detection rules that combine events across sources and time. "Fifty failed logins followed by a success from a new country" or "an admin account created at 3 a.m. and then used to export a database" are typical rules. When one matches, it raises an **alert** for an analyst, usually in a security operations center.

It is also the organization's memory. During an investigation, analysts search months of logs to reconstruct what an attacker did, and auditors ask for proof that access is monitored, which is why regulations often push companies toward one. The hard part is tuning: a SIEM with too many noisy rules buries real attacks under thousands of false alarms, and one with too few misses them. Modern products add behavior analytics, threat intelligence feeds and automated responses, and many now run as a cloud service.

## An analogy

The control room of a building's security, where every camera, door sensor and badge reader sends its feed. One guard watching many screens, with software that rings a bell when the same badge opens doors on two different floors at once.

## Keep in mind

- Collects and centralizes logs from servers, devices, network gear and cloud services.
- Correlation rules combine events across sources to spot attacks no single log reveals.
- Keeps history for investigations and compliance audits.
- Without careful tuning it drowns analysts in false alarms.

## Go deeper

- [Security information and event management on Wikipedia](https://en.wikipedia.org/wiki/Security_information_and_event_management)
- [What is SIEM? (IBM)](https://www.ibm.com/think/topics/siem)

## Related terms

- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Firewall](https://tidbit.legios.com.ar/firewall/): A gatekeeper that decides which network traffic gets in or out.
- [VPN](https://tidbit.legios.com.ar/vpn/): An encrypted tunnel that sends all your traffic through another network first.
- [Cloud computing](https://tidbit.legios.com.ar/cloud-computing/): Renting computers over the internet instead of buying your own.
- [Linux](https://tidbit.legios.com.ar/linux/): A free, open source operating system that runs most of the internet's servers.
- [Database](https://tidbit.legios.com.ar/database/): An organized store of data that programs can search and update safely.
- [Security operations center](https://tidbit.legios.com.ar/security-operations-center/): The team that watches an organization's systems around the clock for attacks.