Security information and event management (SIEM) is a set of tools and services offering a holistic view of an organization's information security, using predetermined rules to help security teams define threats and generate alerts. As such, they collect, aggregate and analyze volumes of data from an organization's applications, devices, servers and users in real time so security teams can detect and block attacks.
A SIEM, or security information and event management solution, aggregates security event data from application, network, endpoint and cloud environments and then utilizes it for security monitoring, threat detection and response, and sometimes risk scoring.
In 2005, Gartner analysts Mark Nicolett and Amrit Williams coined the term SIEM or security information and event management system. A SIEM combined the capabilities of:
As defined by Williams and Nicollet, a SIEM solution shall:
SIEM software collects, stores, analyzes and reports on log data that is generated by various systems and applications in a network. It monitors security-related activities, such as user logins, file access and changes to critical system files. SIEM vendors will often include or sell additional functionality as add-ons, including user and entity behavior analytics (UEBA) and response actions via security orchestration, automation and response (SOAR).
SIEM tools are tools that help monitor and manage security events through the use of data analytics and automation. They can be used to detect malicious activity on your network by monitoring all traffic that comes in and out of the network.
SIEMs were built to collect logs, aggregate data and analyze it from an organization's applications, devices, servers and users in real time so security teams can detect and block attacks, with the primary driver being compliance.
SIEM tools use predetermined rules to help security teams define threats and generate alerts. SIEMs take a somewhat imprecise approach to identifying threats, thereby running security analytics on top of huge datasets.
SIEM tools provide a central place to collect and log events and alerts, yet can be expensive and resource intensive, requiring frequent tuning and updates to rules.
A typical SIEM process includes the following four steps:
SIEM tools can also be used for forensics and compliance purposes. They can be used to track user activity, system changes and other security-related activities, which can be used to generate reports and alerts.
SIEM tools are a key component of any organization’s security information infrastructure. They are essential for any enterprise security strategy. They also provide organizations with visibility into the security of their environments and can help organizations identify areas of improvement.
Security information and event management (SIEM) technology supports threat detection, compliance and security incident management through the collection and analysis (both near-real time and historical) of security events, as well as a wide variety of other event and contextual data sources.
They’re important because they can also help organizations to proactively identify potential threats and take preventive measures to protect their networks. By automating security tasks, SIEM tools allow security personnel to focus on more important tasks.
Next-gen SIEM incorporates two key technologies: user and entity behavior analytics (UEBA) and security orchestration and automation response (SOAR). These technologies enable complex threat identification, detection of lateral movement, and automated incident response as an integral part of a SIEM's functions.
SOAR adds orchestration, automation and integrations for response to SIEM. As an extension of the SIEM, SOAR allows the manual creation of playbooks to automate frequently used analyst workflows. SOAR tools are also used as “security middleware” that allows disparate security tools to talk to each other.
SIEM solutions can help organizations comply with industry and government regulations by tracking compliance with industry regulations and standards. This way, organizations can ensure that their security policies and procedures are up to date and in compliance with applicable laws, regulations and mandates.
In particular, with a SIEM, compliance requirements related to cybersecurity, data security and privacy, and breach reporting can be much easier for organizations to meet.
SIEM relies heavily on logs of events, also known as an audit trail, to provide real-time insight into potential cybersecurity threats. By analyzing disparate logs over time, SIEMs produce real-time security alerts for further review by IT staff or a security operations center (SOC).
SIEM tools enable IT teams to:
SIEM combines the management of security information and security events. This is accomplished using real-time monitoring and the notification of system administrators.
