Glossary

SIEM (security information and event management)

A platform that centralizes and correlates log and event data across an IT environment to detect and investigate security threats.

Also called: SIEM, security information and event management

A SIEM platform collects logs, network flows, and alerts from firewalls, servers, endpoints, applications, and cloud services, normalizes them into a common format, and stores them centrally for search and long-term retention. Its central function is correlation: matching events across sources against rules or models to surface patterns a single log would not reveal, such as a failed login on one system followed by a privileged action on another.

This differs from a plain log aggregation tool, which centralizes logs but leaves correlation and alerting to the analyst; a SIEM adds detection content, rule chains, and often user and entity behavior analytics on top. Many SIEMs also feed alerts to a SOAR platform, which automates the response once the SIEM has raised a case.

SIEMs matter because they are usually the first system an analyst in a security operations center opens, and because many compliance frameworks require centralized log retention and review. The common pitfall is alert fatigue: poorly tuned correlation rules generate far more alerts than a team can triage, burying genuine indicator-of-compromise hits in noise, so tuning and use-case prioritization matter as much as ingestion coverage.

Last reviewed September 22, 2026

In the index now

Related terms

SOAR (security orchestration, automation and response) A platform that automates and orchestrates the response steps a security team takes after an alert is raised. Security operations center (SOC) The team responsible for continuously monitoring an organization's systems, triaging alerts, and coordinating incident response. Indicator of compromise (IOC) A piece of forensic evidence, such as a file hash or IP address, suggesting a system has been breached or contacted by an attacker. Threat intelligence Analyzed information about attacker groups, tools, and techniques used to anticipate and defend against threats, not just react to them. Log aggregation Collecting log data from many separate systems into one centralized, searchable store instead of checking each system individually. User and entity behavior analytics (UEBA) Analytics that baseline normal user and device behavior and flag deviations that could signal a compromise, even without a known IOC.

Related tools

Censys Internet-wide scanning platform that maps public-facing infrastructure for attack-surface management and adversary-infrastructure tracking. CrowdStrike Falcon LogScale Index-free log management engine (formerly Humio) now sold by CrowdStrike as the data backbone for its Next-Gen SIEM. Devo Cloud-native SIEM and data analytics platform emphasizing real-time query performance at high ingest volume. Elasticsearch Distributed search and analytics engine underlying the ELK stack, used for log analytics, full-text search and, via Elastic Security, SIEM. Exabeam SIEM/security analytics platform built around behavioral baselining (UEBA) to surface anomalous user and entity activity. Google Security Operations Google Cloud's SIEM, built on the Chronicle backend, offering high-volume, long-retention log search with integrated threat intelligence.

Related guides

Security analytics, explained How security teams turn logs and network noise into detected threats — SIEM, threat intelligence, and the metrics that measure a SOC's speed.