SIEM: Evaluating security events centrally

In short: A platform that collects logs from many systems, correlates them and raises an alarm on suspicious patterns.

In more detail: SIEM stands for security information and event management. Servers, firewalls, sign-in services and applications produce logs. A single entry often looks harmless, but in context with others it reveals an attack. The SIEM brings the data together in one place and evaluates it automatically.

In Depth

Tasks

• Collect: gather logs via agent or syslog.
• Normalise: bring different formats into a common schema.
• Correlate: link events, for example 50 failed sign-ins followed by a successful one from the same address.
• Alert: rules trigger messages or tickets.
• Retain and search: for investigations and evidence, for example for audits.

Example of a rule

Sign-in attempts from the same source address with many different user names within a few minutes point to password spraying. A rule can detect this, score the incident and send an alert to the security team. Unusual times of day, new countries or sudden large data outflows are also typical triggers.

Tools

Well-known products are Splunk, Elastic Security, Microsoft Sentinel and IBM QRadar; free solutions include Wazuh or Graylog. SOAR tools complement them by reacting automatically to alerts (blocking an account, isolating a machine), as does EDR software on end devices.

Pitfalls

A SIEM is only as good as its data sources and rules. Too many imprecise alerts lead to alert fatigue, in which real warnings get lost. Logs often contain personal data, so access, retention period and data protection must be regulated. Synchronised clocks are also important so that events are ordered correctly.

See also: Logging and log level, Audit log, Firewall