SIEM (Security Information and Event Management)
Also known as: Security Information and Event Management, SIEM platform
A security platform that collects and analyzes event data so teams can detect, investigate, document, and respond to threats.
Security Information and Event Management bundles nine jobs into one platform.
- Log collection
- Normalization
- Search
- Correlation
- Detection
- Investigation
- Case management
- Reporting
- Response support A SIEM is only as useful as the data it receives and the work built around it. Compare these rather than feature labels.
- Data-source coverage
- Parsing quality
- Retention
- Evidence kept with a conclusion
- Detection quality
- Permissions
- Who owns the service work
- Total operating cost