Security incident and event management definition
Security incident and event management (SIEM) is a comprehensive way to provide real-time analysis of security alerts in an organization. It combines security event management (which analyzes log and event data in real time to provide threat monitoring, event correlation, and incident response) with security information management (which collects, analyzes, and reports on log data). SIEM systems offer continuous surveillance of security events and detect threats as they occur. It helps organizations meet regulatory compliance requirements by producing relevant reports and documentation.
See also: security event management, event log
What security incident and event management does
- Data collection. SIEM systems aggregate and consolidate log and event data from multiple sources, including firewalls, antivirus software, and intrusion detection systems.
- Data normalization. Converts log data into a standard format for easier analysis.
- Correlation. Links related records and detects patterns that might indicate a security threat.
- Alerting. Notifies system admins or security professionals about suspicious activities.
- Dashboards. Provides visual summaries of security status.
- Data storage. Archives data for compliance, investigations, and other use cases.
- Analysis and reporting. Assists in forensic analysis, compliance reporting, and identification of trends or patterns.
