thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Security Information and Event Management (SIEM)

A platform that collects, normalizes, correlates and analyzes log data from across an environment to detect and investigate threats.

Definition

A SIEM aggregates logs from endpoints, servers, network devices, cloud services and applications, applies correlation rules and analytics, generates alerts and supports search, dashboards, reporting and retention for compliance. Examples include Splunk Enterprise Security, Microsoft Sentinel, Google Security Operations and Cortex XSIAM. Its value depends on log quality and tuning.

Example

Correlating firewall, VPN and Active Directory logs to detect a compromised account.

Exam tip

SIEM is the answer for centralized log correlation; it is detective, not preventive.

Don't confuse it with

Related terms