Home / Knowledge hub / SIEM
Knowledge hub
SIEM
A system that gathers logs from everywhere and raises alerts on suspicious patterns.
What it means
SIEM stands for security information and event management. It collects logs from servers, applications, cloud services, firewalls and identity systems, puts them in one place, and looks for patterns that suggest something is wrong, such as a login from a new country followed by a large download.
A single log line rarely tells a story. A SIEM links lines from different sources, applies rules or analytics, and raises an alert for a person to review. It also keeps the history, so you can look back after an incident.
Why it matters
Without central logs, you piece an incident together from dozens of machines, some of which have already rotated their logs. A SIEM shortens the time between something going wrong and someone noticing, and gives you records to support an investigation or an audit.
Many frameworks expect log collection and review, including PCI DSS and ISO 27001. A SIEM is a common way to meet that, though it is not the only one, and owning one does not mean anyone is watching it. Budget for the people as well as the licence.
How it shows up
You meet it as a hosted service or software that receives logs through agents or connectors, then normalises them into a common format. Analysts write detection rules, tune them, and respond to alerts. Cost often depends on how much data you send, so teams choose carefully what to include.
Failure modes repeat. Important sources are never connected. Applications log too little to be useful, or log secrets. Rules fire so often that people ignore them, which is alert fatigue. Nobody owns the alerts out of hours. Start with good logging and monitoring in the application itself, then decide what goes to the SIEM.
Questions people ask
SIEM, answered
Is a SIEM the same as a log server?
No. A log server stores logs. A SIEM also normalises them into a common format, correlates events across sources and raises alerts for people to review.
Many SIEMs include long-term storage as well, so the two overlap.
Do small companies need a SIEM?
Not always. Many start with built-in cloud logging and alerts, then add a SIEM or a managed service as they grow or as customers and auditors start to ask.
The real need is for someone who reads the alerts.
Will a SIEM detect application attacks?
Only if the application writes useful logs. A SIEM cannot flag a broken access check if the log never records who asked for which record.
Build the logging into the app first, then send it on.
What is the difference between a SIEM and an EDR?
An EDR watches endpoints such as laptops and servers in depth. A SIEM gathers many sources, including EDR alerts, and correlates them across the estate.
They are often used together rather than as alternatives.
How long should logs be kept?
It depends on your regulations and contracts. Some require a year of retention, with the most recent months readily searchable.
Check what applies to you and keep a record of the decision.
Sources
Where this comes from
Related
Terms that sit next to this one
Logging and monitoring
Recording what happens, and actually watching what gets recorded.
Log retention
How long you keep logs, which decides whether you can investigate old incidents.
Security operations centre
A team and room that watch for and respond to threats around the clock.
Alert fatigue
Teams ignoring warnings because too many of them turn out to be noise.
Intrusion detection
Watching network or host activity for signs that someone is breaking in.
Would your logs show the abuse?
A SIEM only sees what applications log. When we exploit a finding we record the request and response, so your team can check whether your own monitoring noticed. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.