SIEM – Security Information and Event Management
SIEM explained: Centralised collection and evaluation of security events – benefits, effort and differentiation from the SOC.
IT Glossary
In brief
A SIEM (Security Information and Event Management) collects log data from servers, network components, cloud services and security tools in one place, normalises it and evaluates it according to defined rules. The aim is to detect anomalies that would otherwise go unnoticed in individual systems.
The benefit arises from correlation: a failed login attempt is harmless, but the same login attempt from an unusual country in combination with a new forwarding rule in the mailbox is not. In addition, a SIEM provides the evidence required by regulations and insurers.
A SIEM is not a self-running system: rules must be maintained, false alarms reduced and alerts processed, in conjunction with a SOC or a managed service. Categorised under IT Security.
Solutions in a new dimension.
One conversation is enough to find out where IT, Microsoft Cloud and AI can take real weight off day-to-day business.
Your contact: Daniel Penninger, Managing Director